Secure Socket Layer for HTTPS
View All Tags
MySQL reads its certificate files when it starts, so replacing a file changes nothing by itself. ALTER INSTANCE RELOAD TLS makes it read them again, with no restart, and connections already open aren't touched.
When a MySQL server's certificate runs out, the clients that check it stop connecting, and the ones that don't carry on. So it's worth knowing the date before that day comes. MySQL will tell you, from any session.
MySQL makes its own certificates the first time it starts, so TLS works with no setup. To check who you're connecting to, your app needs one of those files. Here's where they are in Docker, what each one's for, and how to copy the one you need.
A private key file can start with BEGIN PRIVATE KEY or BEGIN RSA PRIVATE KEY. They hold the same key, but some software, such as the MySql.Data driver for .NET, reads only the second. One option converts it, and it's one that older guides leave out.
A server certificate needs to name the server, and today that means its Subject Alternative Name (SAN). openssl x509 -req doesn't add one unless you give it a file with the names, so here are the steps, in order.
A certificate authority is just a certificate that's allowed to sign others, plus its private key. For servers on your own network, one openssl command makes a private one. The part people get wrong is marking it as a CA, so this states that in the command.
A certificate is a small text file, but you can't read it by opening it. One openssl command tells you who it's for, who signed it, when it ends and which host names it covers, which answers most TLS questions.
The certificate is invalid was about my client certificate, the one VerifyFull needs in SslCert. I'd made it with the usual openssl req -x509, which marks a certificate as a certificate authority on a normal setup, and the driver doesn't accept a CA in that spot.
Connections using insecure transport are prohibited while --require_secure_transport=ON is the server refusing a connection with no TLS, on purpose. MySql.Data puts Authentication to host … failed in front of it, but your password is fine. Your connection string needs TLS turned on.
An account with REQUIRE X509 must present a client certificate. I gave MySql.Data the right one, in SslCert and SslKey, and got Access denied, though the mysql client got in with the same files. The driver reads those PEM files and never sends them.
