[英]Setting up MySQL SSL connections
我的任务是对与MySQL的所有本地和远程连接进行加密,并且所有客户端都必须通过客户端SSL证书进行验证。
但是我什至不能从外壳连接到MySQL,并且总是得到'用户ssluser@localhost
的访问被拒绝...)
平台:
我已按照此说明创建了自签名证书
# Create CA certificate
# -----------
# CN = localdomain.com
$ openssl genrsa 2048 > ca-key.pem
$ openssl req -new -x509 -nodes -days 3600 -key ca-key.pem -out ca.pem
# Create server certificate, remove passphrase, and sign it
# server-cert.pem = public key, server-key.pem = private key
# -----------
# CN = cn1.localdomain.com
$ openssl req -newkey rsa:2048 -days 3600 -nodes -keyout server-key.pem -out server-req.pem
$ openssl rsa -in server-key.pem -out server-key.pem
$ openssl x509 -req -in server-req.pem -days 3600 -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem
# Create client certificate, remove passphrase, and sign it
# client-cert.pem = public key, client-key.pem = private key
# -----------
# CN = cn2.localdomain.com
$ openssl req -newkey rsa:2048 -days 3600 -nodes -keyout client-key.pem -out client-req.pem
$ openssl rsa -in client-key.pem -out client-key.pem
$ openssl x509 -req -in client-req.pem -days 3600 -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out client-cert.pem
我已经创建了MySQL DB用户进行测试
CREATE USER 'ssl-user'@'%' identified by '123';
GRANT USAGE ON *.* TO 'ssluser'@'%' identified by '123' REQUIRE X509;
FLUSH PRIVILEGES;
编辑my.cnf
[mysqld]
ssl-ca=/etc/pki/mysql_ssl/ca.pem
ssl-cert=/etc/pki/mysql_ssl/server-cert.pem
ssl-key=/etc/pki/mysql_ssl/server-key.pem
[client]
ssl-cert=/etc/pki/mysql_ssl/client-cert.pem
ssl-key=/etc/pki/mysql_ssl/client-key.pem
并重新启动mysqld ...
比我试图从外壳连接
mysql -ussluser -p123123123 --ssl-cert=/etc/pki/mysql_ssl/client-cert.pem --ssl-key=/etc/pki/mysql_ssl/client-key.pem
并始终获得“拒绝ssluser@localhost
的访问(使用密码:是)。
我还尝试使用购买的WildCard Comodo证书仅加密连接(但不验证客户端),但没有成功。
我有点困惑,因为我知道很多人实际上都在使用MySQL SSL,但是我仍然无法使其正常运行。 任何帮助将不胜感激。
问题解决了。
添加到my.cnf的客户端SSL部分
[client] ssl-ca=/etc/pki/mysql_ssl/ca-cert.pem ssl-cert=/etc/pki/mysql_ssl/client-cert.pem ssl-key=/etc/pki/mysql_ssl/сlient-key.pem
创建了新的mysql用户
CREATE USER 'x509test'@'%' IDENTIFIED BY 'MyPassword1'; GRANT USAGE ON *.* TO 'x509test'@'%' REQUIRE X509; FLUSH PRIVILEGES;
最后我可以连接
$ mysql --user=x509test --password --ssl-ca=/etc/pki/mysql_ssl/ca-cert.pem --ssl-cert=/etc/pki/mysql_ssl/client-cert.pem --ssl-key=/etc/pki/mysql_ssl/client-key.pem
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.