Secure Connections
Encrypted client-server connections use the TLS protocol. For replicated data to be encrypted, both the master and slave servers require secure connections to be enabled.
Warning
While the above procedure enables a sever to use TLS encrypted connections with clients. Be aware that this DOES NOT ENFORCE the use of encryption in any way!
To make sure connections with specific clients (users @ hosts) are indeed encrypted, the database user profile must be edited with TLS specific GRANT options.
See also: Secure Connections Overview in the MariaDB Knowledge Base.
Compatibility
Note
Support for TLS encrypted connections varies greatly across different versions of MariaDB and MySQL servers. This guide assumes MariaDB version 10.2.x dynamically linked with the TLS library from OpenSSL which supports at least TLSv1.2.
To check your database server for availability of TLS encrypted connections:
SHOW VARIABLES LIKE 'have_ssl';
Variable_name |
Value |
have_ssl |
YES |
SHOW VARIABLES LIKE 'have_openssl';
Variable_name |
Value |
have_openssl |
YES |
Certificate Signing Requests
Create certificate signing requests on any server and client connecting to any other.
Prepare the environment:
$ sudo mkdir -p /etc/mysql/ssl/private
Create a OpenSSL configuration file
/etc/mysql/ssl/openssl.cnf
with the following contents:
#
# OpenSSL configuration for generation of MariaDB/MySQL servers and client
# certificate requests.
# Environment variable '$CN' **MUST** be defined or else OpenSSL aborts.
CN = $ENV::CN
HOME = .
RANDFILE = $ENV::HOME/.rnd
[ req ]
default_bits = 3072
default_keyfile = ${HOME}/private/${CN}.key.pem
encrypt_key = no
default_md = sha256
req_extensions = req_extensions
prompt = no
distinguished_name = req_distinguished_name
[ req_extensions ]
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectKeyIdentifier = hash
[ req_distinguished_name ]
commonName = ${CN}
Create a new certificate signing request as follows:
$ cd /etc/mysql/ssl
$ sudo -s
$ export OPENSSL_CONF=/etc/mysql/ssl/openssl.cnf
$ export CN=aiken.example.net
$ openssl req -new -out ${CN}.req.pem
Generating a 3072 bit RSA private key
..........................................................................
........................................................................++
................................................................++
writing new private key to './private/aiken.example.net.key.pem
Sign Certificates
Go back to the certificate authority environment stored on a secure device:
$ cd /media/$USER/safe_storage/database-ca
Copy the certificate signing request from the database server:
$ scp aiken.example.net:/etc/mysql/ssl/aiken.example.net.req.pem certreqs/
Sign the CSR:
$ export OPENSSL_CONF=./database-ca.cnf
$ openssl ca \
-in ./certreqs/aiken.example.net.req.pem \
-out ./certs/aiken.example.net.cert.pem \
-extensions cert_ext --policy cert_policy
Using configuration from ./database-ca.cnf
Enter pass phrase for ./private/database-ca.key: ********