I configured SSL for MySQL using the following script.
#!/bin/bash
#
mkdir -p /root/abc/ssl_certs
cd /root/abc/ssl_certs
#
echo "--> 1. Create CA cert, private key"
openssl genrsa 2048 > ca-key.pem
echo "--> 2. Create CA cert, certificate"
openssl req -new -x509 -nodes -days 1000 -key ca-key.pem > ca-cert.pem
echo "--> 3. Create Server certificate, key"
openssl req -newkey rsa:2048 -days 1000 -nodes -keyout server-key.pem > server-req.pem
echo "--> 4. Create Server certificate, cert"
openssl x509 -req -in server-req.pem -days 1000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-cert.pem
echo ""
echo
echo ""
echo "--> 5. Create client certificate, key. Use DIFFERENT common name then server!!!!"
echo ""
openssl req -newkey rsa:2048 -days 1000 -nodes -keyout client-key.pem > client-req.pem
echo "6. Create client certificate, cert"
openssl x509 -req -in client-req.pem -days 1000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > client-cert.pem
exit 0
The following files were created:
ca-key.pem ca-cert.pem
server-req.pem server-key.pem server-cert.pem
client-req.pem client-key.pem client-cert.pem
Then I combined server-cert.pem and client-cert.pem into ca.pem
(I read in a post to do so..)
I created a ssl user in MySQL:
GRANT ALL ON *.* to sslsuer@hostname IDENTIFIED BY 'pwd' REQUIRE SSL;
Next I added the following in my.cnf
[mysqld]
ssl-ca = /root/abc/ssl_certs/ca.pem
ssl-cert = /root/abc/ssl_certs/server-cert.pem
ssl-key = /root/abc/ssl_certs/server-key.pem
After restarting the server,I connected to mysql but SSL was still not in use :(
mysql -u ssluser -p
SSL: Not in use
Even the have_ssl parameter was still showing disabled.. :(
mysql> show variables like '%ssl%';
+---------------+---------------------------------------------+
| Variable_name | Value |
+---------------+---------------------------------------------+
| have_openssl | DISABLED |
| have_ssl | DISABLED |
| ssl_ca | /root/abc/ssl_certs/ca.pem |
| ssl_capath | |
| ssl_cert | /root/abc/ssl_certs/server-cert.pem |
| ssl_cipher | |
| ssl_key | /root/abc/ssl_certs/server-key.pem |
+---------------+---------------------------------------------+
Have I missed any step, or whats wrong..
Answers with missed steps in detail will be highly appreciated..
