使用SSL拒绝对MySQL远程连接尝试的访问

Question

I've setup a MySQL server v5.5.41 for SSL and I'm to trying to connect it remotely. I've created the SSL certs, keys, created a user and granted privileges like this:

GRANT SELECT ON mydb.* TO 'myuser'@'xxx.xxx.xxx.xxx' require x509;

I've updated the my.cnf file on the server like:

ssl-ca   = /etc/mysql/certs/ca.pem
ssl-cert = /etc/mysql/certs/server-cert.pem
ssl-key  = /etc/mysql/certs/server-key.pem

I've done the same with the client pem files (and ca.pem ), adding them to my.cnf (under the client section). I've also updated (Linux) /etc/apparmor.d/usr.sbin.mysqld since I'm putting my pem files in a new directory that I created ( certs ).

And it all works! Except when I repeat the process of creating client pem files and user/privileges for my local development machine. I've done everything exactly the same, but when I try to connect, I get:

ERROR 1045 (28000): Access denied for user 'testuser'@'xxx.xxx.xxx.xxx' (using password: YES)

I've created the testuser on the mysql server and granted privileges in exactly the same way as before (verified by querying the DB). The client pems and ca.pem are on the box, and the cnf file has been updated. I've restarted MySQL. The password I'm using to connect to the server is definitely correct.

The only thing I can think of that's different is when I was creating the client cert, I didn't know what to put in for the Common Name. In the other case, where it's working, that machine is a web server, so the Common Name I used is the domain. For my development machine, I just used what I got from running the hostname command for the Common Name. If this is the problem, what should the Common Name be?

Answer 1

The reason for the problem was because I accidentally put these lines:

ssl-cert = /etc/mysql/certs/client-cert.pem
ssl-key  = /etc/mysql/certs/client-key.pem

...on my local development machine under the [mysqld_safe] section instead of the [client] section in my.cnf , so there's no inherent MySQL or SSL issue here (although if I hadn't written up this question it might have taken me a lot longer to discover that).