List:General Discussion« Previous MessageNext Message »
From:Reindl Harald Date:November 25 2012 12:02am
Subject:Re: Failed to setup SSL
View as plain text  

Am 25.11.2012 00:30, schrieb Jackie Zhang:
> Hello everyone,
> 
> I want to setup SSL for mysql server. I followed the manual on
> http://dev.mysql.com/doc/refman/5.5/en/ssl-connections.html
> 
> I first generated the certificates and key files by strictly following the
> following link,
> http://dev.mysql.com/doc/refman/5.5/en/creating-ssl-certs.html
> with everything verified:
> 
> shell> *openssl verify -CAfile ca-cert.pem server-cert.pem client-cert.pem*
> server-cert.pem: OK
> client-cert.pem: OK
> 
> 
> But, when I start my server using
> bin/mysqld --ssl-ca=./newcerts/ca-cert.pem \
>                  --ssl-cert=./newcerts/server-cert.pem \
>                  --ssl-key=./newcerts/server-key.pem
> 
> The server started with the following error message:
> 121124 14:41:27 [Warning] Failed to setup SSL
> 121124 14:41:27 [Warning] SSL error: Failed to set ciphers to use
> 
> Did I miss something? I tried to add
> --ssl-cipher=DHE-RSA-AES256-SHA:AES128-SHA and --ssl, but it didn't help.
> 
> Please give me some clue...

i used the script below for generate ca.crt, client.pem, server.pem
this setup works since years for replication as also php-scripts

[root@buildserver:~]$ cat /buildserver/ssl-cert/mysql/generate.sh
#!/bin/bash

DIR="/buildserver/ssl-cert/mysql"

rm -rf $DIR/cert/
rm -rf $DIR/db/
mkdir $DIR/cert/
mkdir $DIR/db/

touch $DIR/db/index.txt
echo "01" > $DIR/db/serial

rm -f $DIR/ca.key
rm -f $DIR/cert/ca.crt

openssl req -new -x509 -days 3650 -keyout $DIR/ca.key -out $DIR/cert/ca.crt -config
$DIR/openssl.cnf

openssl req -new -keyout $DIR/cert/server.key -out $DIR/cert/server.csr -days 3650 -config
$DIR/openssl.cnf

openssl rsa -in $DIR/cert/server.key -out $DIR/cert/server.key
openssl ca -policy policy_anything -out $DIR/cert/server.crt -days 3650 -config
$DIR/openssl.cnf -infiles
$DIR/cert/server.csr

openssl req -new -keyout $DIR/cert/client.key -out $DIR/cert/client.csr -days 3650 -config
$DIR/openssl.cnf
openssl rsa -in $DIR/cert/client.key -out $DIR/cert/client.key
openssl ca -policy policy_anything -out $DIR/cert/client.crt -days 3650 -config
$DIR/openssl.cnf -infiles
$DIR/cert/client.csr

rm -f $DIR/cert/server.csr
rm -f $DIR/cert/client.csr
rm -f $DIR/cert/01.pem
rm -f $DIR/cert/02.pem

cat $DIR/cert/server.crt $DIR/cert/server.key > $DIR/cert/server.pem
rm -f $DIR/cert/server.crt
rm -f $DIR/cert/server.key

cat $DIR/cert/client.crt $DIR/cert/client.key > $DIR/cert/client.pem
rm -f $DIR/cert/client.crt
rm -f $DIR/cert/client.key

chmod 644 $DIR/cert/*
rm -f /etc/mysql-ssl/*
cp $DIR/cert/* /etc/mysql-ssl/
chmod 755 /etc/mysql-ssl/
chmod 644 /etc/mysql-ssl/*



Attachment: [application/pgp-signature] OpenPGP digital signature signature.asc
Thread
Failed to setup SSLJackie Zhang24 Nov
  • Re: Failed to setup SSLReindl Harald25 Nov
    • Re: Failed to setup SSLJackie Zhang25 Nov
Re: Failed to setup SSLMichael Dykman25 Nov
  • Re: Failed to setup SSLJackie Zhang25 Nov