自签名tomcat和mysql / mariadb

Question

G'day folks

trying to use certs for securing connections between Tomcat 8.x and mysql/mariadb. I'm going to use a self-signed cert. What follows is what i think i should be going and appreciate you to jump in and correct me.

Create Backend(DB) certs

-sudo openssl genrsa 4096 > ca-key.pem

-sudo openssl req -new -x509 -nodes -days 3600 -key ca-key.pem -out ca-cert.pem

-sudo openssl req -newkey rsa:4096 -days 3600 -nodes -keyout server-key.pem -out server-req.pem

-sudo openssl rsa -in server-key.pem -out server-key.pem

-sudo openssl x509 -req -in server-req.pem -days 3600 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem

update the mysql cnf

ca-key.pem
server-key.pem
server-cert.pem

Ok, here's where i don't know how to proceed. I think i have to use the JAVA keytool .

Where do i go from here ?

ta OSP

Answer 1

Assume you are looking for a one way SSL where MySQL is the server and Tomacat is the client which needs JDBC over ssl.

1. In MySQL environment set the path of CA and server certificates in the configuration file my.cnf

    ssl-ca=<PATH>/ca-cert.pem ssl-cert=<PATH>server-cert.pem ssl-key=<PATH>server-key.pem 

2. In Tomcat environment import your MySQL CA certificate.

   keytool -import -alias mysqlcacert -file ca-cert.pem -keystore truststore

3. If not already done , set truststore path in catalina.sh/bat

     JAVA_OPTS="$JAVA_OPTS -Djavax.net.ssl.keyStore=<PATH>keystore" JAVA_OPTS="$JAVA_OPTS -Djavax.net.ssl.keyStorePassword=<password>" 

4. JDBC url

    url="jdbc:mysql://host:port/db?autoReconnect=true&verifyServerCertificate=true&useSSL=true&requireSSL=true";