MySQL开启SSL

1.生成证书

mysql_ssl_rsa_setup
ll /srv/mysql/data/*.pem

2.修改my.cnf
nano -w etc/my.cnf

[mysqld]
ssl-ca = /srv/mysql/data/ca.pem 
ssl-cert = /srv/mysql/data/server-cert.pem 
ssl-key = /srv/mysql/data/server-key.pem

3.确认是否开启SSL

show global variables like 'have_%ssl';

+---------------+-------+
| Variable_name | Value |
+---------------+-------+
| have_openssl  | YES   |
| have_ssl      | YES   |
+---------------+-------+
2 rows in set (0.00 sec)

4.查看SSL的加密方式

show global variables like 'tls_version';

+---------------+---------------+
| Variable_name | Value         |
+---------------+---------------+
| tls_version   | TLSv1,TLSv1.1 |
+---------------+---------------+
1 row in set (0.00 sec)

5.配置SSL用户

grant all privileges on *.* to root@'%' identified by '123456' require none;
grant all privileges on *.* to bfs@'%' identified by '123456' require ssl;
flush privileges;

6.登陆测试

mysql --ssl-ca=/srv/mysql/data/ca.pem \
      --ssl-cert=/srv/mysql/data/client-cert.pem \
      --ssl-key=/srv/mysql/data/client-key.pem \
      -uroot -p -hlocalhost

7.配置客户端支持

[client]
ssl-ca = /srv/mysql/data/ca.pem
ssl-cert = /srv/mysql/data/client-cert.pem
ssl-key = /srv/mysql/data/client-key.pem

8.建立truststore
keytool -import -alias mysqlServerCACert -file server-cert.pem -keystore truststore
删除
keytool -delete -alias emailcert -keystore truststore
9.建立keystore
openssl x509 -outform DER -in client-cert.pem -out client.cert
keytool -import -file client.cert -keystore keystore -alias mysqlClientCertificate