When a MySQL server's certificate runs out, the clients that check it stop connecting, and the ones that don't carry on. So it's worth knowing the date before that day comes. MySQL will tell you, from any session.
MySQL makes its own certificates the first time it starts, so TLS works with no setup. To check who you're connecting to, your app needs one of those files. Here's where they are in Docker, what each one's for, and how to copy the one you need.
A private key file can start with BEGIN PRIVATE KEY or BEGIN RSA PRIVATE KEY. They hold the same key, but some software, such as the MySql.Data driver for .NET, reads only the second. One option converts it, and it's one that older guides leave out.
A server certificate needs to name the server, and today that means its Subject Alternative Name (SAN). openssl x509 -req doesn't add one unless you give it a file with the names, so here are the steps, in order.
A certificate authority is just a certificate that's allowed to sign others, plus its private key. For servers on your own network, one openssl command makes a private one. The part people get wrong is marking it as a CA, so this states that in the command.
A certificate is a small text file, but you can't read it by opening it. One openssl command tells you who it's for, who signed it, when it ends and which host names it covers, which answers most TLS questions.
I published my API and started it with dotnet publish/Dewiride.Inventory.Api.dll. It ran and it answered, and it logged SQL statements that its appsettings.json turns off. The file was right there, and nothing said it wasn't being read.
My plain-text logs came out as 2026-11-06T08:00:35.102Zinfo: Program[0], with the timestamp stuck to the log level. A TimestampFormat I'd set for JSON logs had carried over to Development. Here's why, and three ways to fix it.
#:property and #:package lines configure a one-file C# program, so they have to come before anything else in it. Mine was below a using, so the build stopped with CS9297. Moving it up fixes it.
JsonSerializer.Serialize is about as ordinary as C# gets, so Reflection-based serialization has been disabled for this application was a surprise, in a one-file program with nothing else in it. File-based apps turn this off by default. There are two ways to deal with that.
