我使用以下脚本为MySQLconfiguration了SSL。
#!/bin/bash # mkdir -p /root/abc/ssl_certs cd /root/abc/ssl_certs # echo "--> 1. Create CA cert, private key" openssl genrsa 2048 > ca-key.pem echo "--> 2. Create CA cert, certificate" openssl req -new -x509 -nodes -days 1000 -key ca-key.pem > ca-cert.pem echo "--> 3. Create Server certificate, key" openssl req -newkey rsa:2048 -days 1000 -nodes -keyout server-key.pem > server-req.pem echo "--> 4. Create Server certificate, cert" openssl x509 -req -in server-req.pem -days 1000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-cert.pem echo "" echo echo "" echo "--> 5. Create client certificate, key. Use DIFFERENT common name then server!!!!" echo "" openssl req -newkey rsa:2048 -days 1000 -nodes -keyout client-key.pem > client-req.pem echo "6. Create client certificate, cert" openssl x509 -req -in client-req.pem -days 1000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > client-cert.pem exit 0
以下文件已创build:
ca-key.pem ca-cert.pem server-req.pem server-key.pem server-cert.pem client-req.pem client-key.pem client-cert.pem
然后,我将server-cert.pem和client-cert.pem结合到ca.pem(我在一篇文章中读到了这样做..)
我在MySQL中创build了一个ssl用户:
GRANT ALL ON *.* to sslsuer@hostname IDENTIFIED BY 'pwd' REQUIRE SSL;
接下来,我在my.cnf中添加了以下内容
[mysqld] ssl-ca = /root/abc/ssl_certs/ca.pem ssl-cert = /root/abc/ssl_certs/server-cert.pem ssl-key = /root/abc/ssl_certs/server-key.pem
重新启动服务器后,我连接到MySQL但SSL仍然没有使用:(
mysql -u ssluser -p SSL: Not in use
即使是has_ssl参数仍然显示禁用.. 🙁
mysql> show variables like '%ssl%'; +---------------+---------------------------------------------+ | Variable_name | Value | +---------------+---------------------------------------------+ | have_openssl | DISABLED | | have_ssl | DISABLED | | ssl_ca | /root/abc/ssl_certs/ca.pem | | ssl_capath | | | ssl_cert | /root/abc/ssl_certs/server-cert.pem | | ssl_cipher | | | ssl_key | /root/abc/ssl_certs/server-key.pem | +---------------+---------------------------------------------+
我错过了任何一步,或什么是错的..
错过了详细步骤的答案将高度赞赏..
在这里看到解决scheme: https : //askubuntu.com/questions/194074/enabling-ssl-in-mysql
您需要将证书转换为旧格式:
openssl rsa -in client-key.pem -out client-key.pem openssl rsa -in server-key.pem -out server-key.pem
尝试检查这个:
mysql
?)读取文件。 在/root
我不认为这是默认情况下。 在Ubuntu上,您可以检查apparmor
阻止访问您的证书文件, 请参阅手册 。
然后,您应该检查文件权限/所有权,并将必要的权限添加到/etc/apparmor.d/usr.sbin.mysqld
。 看到这个线程 。
我相信这个问题是由于您没有正确指定您的CA证书,服务器密钥和服务器证书的文件path。 它必须是以下格式…
ssl-ca=path/to/repo/mysql-directory/path/to/pem/cacert.pem ssl-cert=path/to/repo/mysql-directory/path/to/pem/server-cert.pem ssl-key=path/to/repo/mysql-directory/path/to/pem/server-key.pem
即你需要MySQL安装文件夹中的证书和密钥的完整文件path而不是相对的“/ root /”path。
以下是我的安装示例:
mysql> show variables like '%ssl%'; +---------------+----------------------------------------------------------+ | Variable_name | Value | +---------------+----------------------------------------------------------+ | have_openssl | YES | | have_ssl | YES | | ssl_ca | C:/wamp64/bin/mysql/mysql5.7.14/etc/certs/ca.pem | | ssl_capath | | | ssl_cert | C:/wamp64/bin/mysql/mysql5.7.14/etc/certs/server-cert.pem| | ssl_cipher | | | ssl_key | C:/wamp64/bin/mysql/mysql5.7.14/etc/certs/server-key.pem | +---------------+----------------------------------------------------------+
请参阅以下链接了解更多信息。 https://dev.mysql.com/doc/connector-net/en/connector-net-tutorials-ssl.html
像my.cnf
文件中的[mysqld]
部分添加“ssl”
ssl ssl-ca = /root/abc/ssl_certs/ca.pem ssl-cert = /root/abc/ssl_certs/server-cert.pem ssl-key = /root/abc/ssl_certs/server-key.pem
然后重新启动mysql并再次检查。 它会工作。