#证书存放路径
mkdir ~/cert
cd ~/cert
#生成服务器证书
openssl genrsa 2048 > ca-key.pem;
openssl req -sha1 -new -x509 -nodes -days 3650 -key ca-key.pem > ca-cert.pem
openssl req -sha1 -newkey rsa:2048 -days 3650 -nodes -keyout server-key.pem > server-req.pem
openssl x509 -sha1 -req -in server-req.pem -days 3650 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-cert.pem
openssl rsa -in server-key.pem -out server-key.pem
#生成客户端证书
openssl req -sha1 -newkey rsa:2048 -days 3650 -nodes -keyout client-key.pem > client-req.pem
openssl x509 -sha1 -req -in client-req.pem -days 3650 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > client-cert.pem;
openssl rsa -in client-key.pem -out client-key.pem
#上面生成过程输入的信息保持一致
#验证是否ok
openssl verify -CAfile ca-cert.pem server-cert.pem client-cert.pem
#复制到目录
mkdir /etc/mysql-ssl
cp ca-cert.pem server-cert.pem server-key.pem /etc/mysql-ssl
#修改mysql配置,/etc/mysql/my.cnf
[mysqld]
ssl-ca=/etc/mysql-ssl/ca-cert.pem
ssl-cert=/etc/mysql-ssl/server-cert.pem
ssl-key=/etc/mysql-ssl/server-key.pem
[client]
ssl-cert=/etc/mysql-ssl/client-cert.pem
ssl-key=/etc/mysql-ssl/client-key.pem
#重启mysql
service mysql restart
systemctl restart mysql
/etc/init.d/mysql restart
#看日志启动正常
#强制用户使用ssl
GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '123456' REQUIRE SSL;
FLUSH PRIVILEGES;
#连接测试
mysql --ssl-ca=ca-cert.pem --ssl-cert=client-cert.pem --ssl-key=client-key.pem -h 127.0.0.1 -u root -p
#如果配置[client]证书,可以直接连:
mysql -h 192.168.3.48 -u root -p
#接验证连接是否用了ssl
mysql> status
#MySQL5.7默认是开启SSL连接,如果强制用户使用SSL连接,那么应用程序的配置也需要明确指定SSL相关参数,否则程序会报错。