One database encrypts its connections and the other does not

What we found

Of the two databases on the MariaDB platform, one has encryption switched on for its connections and the other has it explicitly switched off. The platform issues and renews the certificates itself, so there was no cost to having it on — it had simply been opted out of on one service.

Impact

Low in practice: this traffic never leaves the platform's internal network. The reason it is worth fixing is consistency — two services behaving differently is how an assumption about protection quietly stops being true.

Fix

Remove the opt-out so the service inherits the platform default, which is encryption on. Certificates are issued automatically and rotate on their own, and existing connections are unaffected because encryption is offered rather than enforced.