8.2.19. Configure SSL for MySQL

When a certificate is installed or removed, the instance is restarted.

TLS/SSL encryption is used to secure data transmitted between the client and the server. Follow these instructions to configure encryption using your own SSL certificate with hostname validation.

  1. Generate the certificate and key files (in the command, replace example.mysql.network in two lines with the host address of your instance):
    openssl req -x509 -newkey rsa:2048 \
  -sha256 -days 365 \
  -nodes \
  -keyout server-key.pem \
  -out server-cert.pem \
  -subj "/CN=example.mysql.network" \
  -addext "subjectAltName=DNS:example.mysql.network" \
  -addext "keyUsage=digitalSignature,keyEncipherment" \
  -addext "extendedKeyUsage=serverAuth"
  2. Install the certificate in the "MySQL" section on the "Settings → SSL" tab (leave the private key password field blank if you did not specify one when generating the certificate and key):
  3. Check the host address in the installed certificate (use your connection credentials in the command: example.mysql.network — host, 12345 — port):
    openssl s_client -connect example.mysql.network:12345 -starttls mysql -showcerts </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -ext subjectAltName

    Without a certificate installed, the output looks like this: 

    subject=CN = MySQL_Server_8.0.36-28_Auto_Generated_Server_Certificate
issuer=CN = MySQL_Server_8.0.36-28_Auto_Generated_CA_Certificate
No extensions in certificate

    After installing the certificate, the output will show the host address of your instance: 

    subject=CN = example.mysql.network
issuer=CN = example.mysql.network
X509v3 Subject Alternative Name:
    DNS:example.mysql.network
  4. Connect to the instance using a certificate and make sure the connection is encrypted (use your connection credentials in the command: example.mysql.network — host, 12345 — port, user — username):
    mysql -h example.mysql.network -P 12345 -u user -p \
  --ssl-mode=VERIFY_IDENTITY \
  --ssl-ca=server-cert.pem \
  -e "SHOW STATUS LIKE 'Ssl_cipher'; SHOW STATUS LIKE 'Ssl_version';"

    If everything is configured correctly, the connection is established successfully, and the output looks like this: 

    +---------------+------------------------+
| Variable_name | Value                  |
+---------------+------------------------+
| Ssl_cipher    | TLS_AES_256_GCM_SHA384 |
+---------------+------------------------+
+---------------+---------+
| Variable_name | Value   |
+---------------+---------+
| Ssl_version   | TLSv1.3 |
+---------------+---------+

When connecting to the instance via a MySQL client, select the VERIFY_IDENTITY mode and use the server certificate as the CA certificate. Do not specify a client certificate or key.

Content