mysql配置使用ssl

#证书存放路径
mkdir ~/cert
cd ~/cert

#生成服务器证书
openssl genrsa 2048 > ca-key.pem;
openssl req -sha1 -new -x509 -nodes -days 3650 -key ca-key.pem > ca-cert.pem

openssl req -sha1 -newkey rsa:2048 -days 3650 -nodes -keyout server-key.pem > server-req.pem
openssl x509 -sha1 -req -in server-req.pem -days 3650 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-cert.pem
openssl rsa -in server-key.pem -out server-key.pem

#生成客户端证书
openssl req -sha1 -newkey rsa:2048 -days 3650 -nodes -keyout client-key.pem > client-req.pem
openssl x509 -sha1 -req -in client-req.pem -days 3650 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > client-cert.pem;
openssl rsa -in client-key.pem -out client-key.pem

#上面生成过程输入的信息保持一致

#验证是否ok
openssl verify -CAfile ca-cert.pem server-cert.pem client-cert.pem

#复制到目录
mkdir /etc/mysql-ssl
cp ca-cert.pem server-cert.pem server-key.pem /etc/mysql-ssl


#修改mysql配置，/etc/mysql/my.cnf
[mysqld]
ssl-ca=/etc/mysql-ssl/ca-cert.pem
ssl-cert=/etc/mysql-ssl/server-cert.pem
ssl-key=/etc/mysql-ssl/server-key.pem

[client]
ssl-cert=/etc/mysql-ssl/client-cert.pem
ssl-key=/etc/mysql-ssl/client-key.pem


#重启mysql
service mysql restart
systemctl restart mysql 
/etc/init.d/mysql restart

#看日志启动正常

#强制用户使用ssl
GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '123456' REQUIRE SSL;
FLUSH PRIVILEGES;

#连接测试
mysql --ssl-ca=ca-cert.pem --ssl-cert=client-cert.pem --ssl-key=client-key.pem -h 127.0.0.1 -u root -p

#如果配置[client]证书，可以直接连：
mysql -h 192.168.3.48 -u root -p


#接验证连接是否用了ssl
mysql> status


#MySQL5.7默认是开启SSL连接，如果强制用户使用SSL连接，那么应用程序的配置也需要明确指定SSL相关参数，否则程序会报错。