Mysql

MySQL

MySQL server with SSL

1. Create openssl directory structure for MySQL

 mkdir -p /etc/pki/openssl
 mkdir -p /etc/pki/openssl/private
 mkdir -p /etc/pki/openssl/newcerts
 

1. Initialize Index database

 touch /etc/pki/openssl/index.txt
 

1. Create control serial number

 date +%Y%m%d > /etc/pki/openssl/serial
 

1. Copy default openssl configuration file

 cp /etc/pki/tls/openssl.cnf /etc/pki/openssl/
 

1. Change the default dir on the new configuration file

 replace ../../CA /etc/pki/openssl  -- /etc/pki/openssl/openssl.cnf
 

1. Generate CA

 openssl req -new -x509 -keyout /etc/pki/openssl/private/cakey.pem -out /etc/pki/openssl/cacert.pem -config /etc/pki/openssl.cnf
 

1. Create Server REQ and KEY

 openssl req -new -keyout /etc/pki/openssl/server-key.pem -out /etc/pki/openssl/server-req.pem -days 3600 -config /etc/pki/openssl/openssl.cnf
 

1. Remove passphrase from KEY

 openssl rsa -in /etc/pki/openssl/server-key.pem -out /etc/pki/openssl/server-key.pem
 

1. Sign server cert

 openssl ca -policy policy_anything -out /etc/pki/openssl/server-cert.pem -config /etc/pki/openssl/openssl.cnf -infiles /etc/pki/openssl/server-req.pem
 

1. Create REQ and KEY for the client

 openssl req -new -keyout /etc/pki/openssl/client-key.pem -out /etc/pki/openssl/client-req.pem -days 3600 -config /etc/pki/openssl/openssl.cnf
 

1. Remove passphrase from the client KEY

 openssl rsa -in /etc/pki/openssl/client-key.pem  -out /etc/pki/openssl/client-key.pem
 

1. Sign client cert

 openssl ca -policy policy_anything -out /etc/pki/openssl/client-cert.pem -config /etc/pki/openssl/openssl.cnf -infiles /etc/pki/openssl/client-req.pem
 

1. Add the following under each directive on `/etc/my.cnf`, if the directive doesn't exists it should be created

 [client]
 ssl-ca=/etc/pki/openssl/cacert.pem
 ssl-cert=/etc/pki/openssl/client-cert.pem
 ssl-key=/etc/pki/openssl/client-key.pem

 [mysqld]
 ssl-ca=/etc/pki/openssl/cacert.pem
 ssl-cert=/etc/pki/openssl/server-cert.pem
 ssl-key=/etc/pki/openssl/server-key.pem
 

1. Restart the server

 service mysqld restart
 

1. Test ssl on Mysql
   1. Login into MySQL Server

 mysql -u root -p
 

1. Check SSL Cipher

 mysql> show status like 'Ssl_cipher';
 +--------------+-------------------+
 | Variable_name| Value             |
 +--------------+-------------------+
 | Ssl_cipher   | DHE-RSA-AES256-SHA|
 +--------------+-------------------+

 1 row in set (0.01 sec)
 

# Done