Trusted drivers for Edge connections

Trusted drivers allows your security team to control which database drivers are allowed to run on your Edge site. You sign your approved drivers with your private key, add the public key to your Edge site via the Edge CLI, and Edge verifies each driver signature against your public key before using it. Any driver that hasn't been signed or whose signature doesn't match is blocked and the connection fails.

You can also set up and manage trusted drivers via Edge APIs.

Note This setting is applied on the Edge site level. If enabled, all connections on your Edge site must use a trusted driver.

Prerequisites

  • You installed and configured the Edge CLI tool.
  • You have permission to manage the Edge site's configuration.
  • You have a RSA public/private key pair generated by your organization, and are able to add the public key to the Edge site.

Deploy or rotate the signing key

Use this command to deploy a public key or to replace an existing key. The command automatically restarts the affected Edge services, so the change takes effect immediately. You don't need to manually restart your Edge site.

Warning When you deploy a key, it applies to every driver already configured on the Edge site, not just new ones. If existing connections use unsigned drivers, those connections will immediately start to fail. Re-sign all affected drivers before deploying a key to a live environment.

  • Edge sites installed via k3s:
    Copy
    sudo ./edgecli config signing-key set --file <path-to-public-key.pem> [--force]
  • Edge sites installed via Edge CLI:
    Copy
    ./edgecli config signing-key set --file <path-to-public-key.pem> [--force]
Flag Required Description
--file Yes The path to a PEM file containing the public key.
  • The PEM file must contain exactly one PUBLIC KEY block.
  • Certificate files and private key files are rejected.
  • The key must be RSA (SHA256withRSA) and at least 1024 bits.
--force Only when replacing an existing key Confirms the overwrite. Without this flag, the command won't replace a key that is already deployed.

Warning Rotating a key invalidates all driver signatures made under the previous key. Re-sign affected drivers before rotating a key in a live environment, not after.

Check the current signing key

Use this command to confirm whether a signing key is configured on the Edge site. This command returns only the key algorithm and bit size, it never returns the key material itself.

  • Edge sites installed via k3s:
    Copy
    ./edgecli config signing-key show
  • Edge sites installed via Edge CLI:
    Copy
    ./edgecli config signing-key show

Remove the signing key

Use this command to remove the signing key from the Edge site. This immediately disables all signature verification across the entire site.

Warning Removing the signing key immediately disables driver verification for every connection on the Edge site. After this command runs, any driver, whether signed or unsigned, is accepted.

  • Edge sites installed via k3s:
    Copy
    ./edgecli config signing-key delete
  • Edge sites installed via Edge CLI:
    Copy
    ./edgecli config signing-key delete

What's next