1

My task is to make all local and remote connections to MySQL encrypted and all clients must be verified by client SSL certificates.

But I can't even connect to MySQL from shell and always getting 'Access denied for user ssluser@localhost...)'


Platform:

  • Amazon EC2 micro with Amazon Linux AMI (all updates installed)
  • MySQL 5.7.7

I have created the self-signed certificate in accordance with this instruction

# Create CA certificate 
# -----------
# CN = localdomain.com

$ openssl genrsa 2048 > ca-key.pem
$ openssl req -new -x509 -nodes -days 3600 -key ca-key.pem -out ca.pem


# Create server certificate, remove passphrase, and sign it
# server-cert.pem = public key, server-key.pem = private key
# ----------- 
# CN = cn1.localdomain.com

$ openssl req -newkey rsa:2048 -days 3600 -nodes -keyout server-key.pem -out server-req.pem
$ openssl rsa -in server-key.pem -out server-key.pem
$ openssl x509 -req -in server-req.pem -days 3600 -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem


# Create client certificate, remove passphrase, and sign it
# client-cert.pem = public key, client-key.pem = private key
# ----------- 
# CN = cn2.localdomain.com

$ openssl req -newkey rsa:2048 -days 3600 -nodes -keyout client-key.pem -out client-req.pem
$ openssl rsa -in client-key.pem -out client-key.pem
$ openssl x509 -req -in client-req.pem -days 3600 -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out client-cert.pem

I have created the MySQL DB user for testing

CREATE USER 'ssl-user'@'%' identified by '123';
GRANT USAGE ON *.* TO 'ssluser'@'%' identified by '123' REQUIRE X509;
FLUSH PRIVILEGES;

Edited my.cnf

[mysqld]
ssl-ca=/etc/pki/mysql_ssl/ca.pem
ssl-cert=/etc/pki/mysql_ssl/server-cert.pem
ssl-key=/etc/pki/mysql_ssl/server-key.pem

[client]
ssl-cert=/etc/pki/mysql_ssl/client-cert.pem
ssl-key=/etc/pki/mysql_ssl/client-key.pem

and restarted mysqld...


Than I am trying to connect from shell

mysql -ussluser -p123123123 --ssl-cert=/etc/pki/mysql_ssl/client-cert.pem --ssl-key=/etc/pki/mysql_ssl/client-key.pem

And always get 'Access denied for ssluser@localhost (using password: YES).

I also tried to use our purchased WildCard Comodo Certificates to only encrypt the connection (but not verify the client) with no success.

I am a bit confused because I know a lot of people actually do MySQL SSL, but I am still can't get it working. Any help would be much appreciated.

1 Answer 1

1

Problem is solved.

  • I switched back to MySQL 5.6
  • Re-created CA, server and client certificates with this detailed instruction
  • Added to my.cnf the client SSL section

    [client]
    ssl-ca=/etc/pki/mysql_ssl/ca-cert.pem
    ssl-cert=/etc/pki/mysql_ssl/client-cert.pem
    ssl-key=/etc/pki/mysql_ssl/сlient-key.pem
    
  • Created new mysql user

    CREATE USER 'x509test'@'%' IDENTIFIED BY 'MyPassword1';
    GRANT USAGE ON *.* TO 'x509test'@'%' REQUIRE X509;
    FLUSH PRIVILEGES;
    

And finally I am able to connect

$ mysql --user=x509test --password --ssl-ca=/etc/pki/mysql_ssl/ca-cert.pem --ssl-cert=/etc/pki/mysql_ssl/client-cert.pem --ssl-key=/etc/pki/mysql_ssl/client-key.pem

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.