实现基于SSL的主从复制

准备：两台主机
1 在主服务器上生成证书

mkdir /etc/my.cnf.d/ssl
cd /etc/my.cnf.d/ssl
openssl genrsa 2048 > cakey.pem
openssl req -new -x509 -key cakey.pem -out cacert.pem -days 3650
openssl req -newkey rsa:1024  -days 365 -nodes -keyout master.key > master.csr
openssl x509 -req -in master.csr -CA cacert.pem -CAkey cakey.pem -set_serial 01 > master.crt
openssl req -newkey rsa:1024  -nodes -keyout slave.key > slave.csr
openssl x509 -req -in slave.csr -CA cacert.pem -CAkey cakey.pem -set_serial 02 > slave.crt

[root@centos7 ssl]#ll 
total 32
-rw-r--r-- 1 root root 1330 Jul 12 14:38 cacert.pem
-rw-r--r-- 1 root root 1675 Jul 12 14:37 cakey.pem
-rw-r--r-- 1 root root 1029 Jul 12 14:42 master.crt
-rw-r--r-- 1 root root  660 Jul 12 14:40 master.csr
-rw-r--r-- 1 root root  916 Jul 12 14:40 master.key
-rw-r--r-- 1 root root 1025 Jul 12 14:43 slave.crt
-rw-r--r-- 1 root root  660 Jul 12 14:43 slave.csr
-rw-r--r-- 1 root root  916 Jul 12 14:43 slave.key

vim /etc/my.cnf
[mysqld]
server-id=7
log-bin
ssl-ca=/etc/my.cnf.d/ssl/cacert.pem
ssl-cert=/etc/my.cnf.d/ssl/master.crt
ssl-key=/etc/my.cnf.d/ssl/master.key



scp -r /etc/my.cnf.d/ssl/  从服务器:/etc/my.cnf.d/

mysql>grant replication slave on *.* to repluser2@'192.168.37.%' identified by 'centos' require ssl;
mysql> show master logs;

2 在从服务器上
测试用户是否支持加密连接

mysql -h192.168.37.7 -urepluser2 -pcentos --ssl-ca=cacert.pem --ssl-cert=slave.crt --ssl-key=slave.key

vim /etc/my.cnf
server-id=17

mysql> CHANGE MASTER TO
MASTER_HOST='主服务器',
MASTER_USER='repluser2',
MASTER_PASSWORD='centos',
MASTER_LOG_FILE='mariadb-bin.000004',
MASTER_LOG_POS=413,
MASTER_SSL=1,
MASTER_SSL_CA = '/etc/my.cnf.d/ssl/cacert.pem',
MASTER_SSL_CERT = '/etc/my.cnf.d/ssl/slave.crt',
MASTER_SSL_KEY = '/etc/my.cnf.d/ssl/slave.key';

mysql>start slave;