1MYSQL_SSL_RSA_SETUP(1) MySQL Database System MYSQL_SSL_RSA_SETUP(1)
2
6 mysql_ssl_rsa_setup - create SSL/RSA files
7
9 mysql_ssl_rsa_setup [options]
10
12 Note
13 mysql_ssl_rsa_setup is deprecated as of MySQL 8.0.34. Instead,
14 consider using MySQL server to generate missing SSL and RSA files
15 automatically at startup (see the section called “Automatic SSL and
16 RSA File Generation”).
17 This program creates the SSL certificate and key files and RSA key-pair
19 files required to support secure connections using SSL and secure
20 password exchange using RSA over unencrypted connections, if those
21 files are missing. mysql_ssl_rsa_setup can also be used to create new
22 SSL files if the existing ones have expired.
23 Note
25 mysql_ssl_rsa_setup uses the openssl command, so its use is
26 contingent on having OpenSSL installed on your machine.
27 Another way to generate SSL and RSA files, for MySQL distributions
29 compiled using OpenSSL, is to have the server generate them
30 automatically. See Section 6.3.3.1, “Creating SSL and RSA
31 Certificates and Keys using MySQL”.
32 Important
34 mysql_ssl_rsa_setup helps lower the barrier to using SSL by making
35 it easier to generate the required files. However, certificates
36 generated by mysql_ssl_rsa_setup are self-signed, which is not very
37 secure. After you gain experience using the files created by
38 mysql_ssl_rsa_setup, consider obtaining a CA certificate from a
39 registered certificate authority.
40 Invoke mysql_ssl_rsa_setup like this:
42 mysql_ssl_rsa_setup [options]
44 Typical options are --datadir to specify where to create the files, and
46 --verbose to see the openssl commands that mysql_ssl_rsa_setup
47 executes.
48 mysql_ssl_rsa_setup attempts to create SSL and RSA files using a
50 default set of file names. It works as follows:
51 1. mysql_ssl_rsa_setup checks for the openssl binary at the locations
53 specified by the PATH environment variable. If openssl is not
54 found, mysql_ssl_rsa_setup does nothing. If openssl is present,
55 mysql_ssl_rsa_setup looks for default SSL and RSA files in the
56 MySQL data directory specified by the --datadir option, or the
57 compiled-in data directory if the --datadir option is not given.
58 2. mysql_ssl_rsa_setup checks the data directory for SSL files with
60 the following names:
61 ca.pem
63 server-cert.pem
64 server-key.pem
65 3. If any of those files are present, mysql_ssl_rsa_setup creates no
67 SSL files. Otherwise, it invokes openssl to create them, plus some
68 additional files:
69 ca.pem Self-signed CA certificate
71 ca-key.pem CA private key
72 server-cert.pem Server certificate
73 server-key.pem Server private key
74 client-cert.pem Client certificate
75 client-key.pem Client private key
76 These files enable secure client connections using SSL; see
78 Section 6.3.1, “Configuring MySQL to Use Encrypted Connections”.
79 4. mysql_ssl_rsa_setup checks the data directory for RSA files with
81 the following names:
82 private_key.pem Private member of private/public key pair
84 public_key.pem Public member of private/public key pair
85 5. If any of these files are present, mysql_ssl_rsa_setup creates no
87 RSA files. Otherwise, it invokes openssl to create them. These
88 files enable secure password exchange using RSA over unencrypted
89 connections for accounts authenticated by the sha256_password or
90 caching_sha2_password plugin; see Section 6.4.1.3, “SHA-256
91 Pluggable Authentication”, and Section 6.4.1.2, “Caching SHA-2
92 Pluggable Authentication”.
93 For information about the characteristics of files created by
95 mysql_ssl_rsa_setup, see Section 6.3.3.1, “Creating SSL and RSA
96 Certificates and Keys using MySQL”.
97 At startup, the MySQL server automatically uses the SSL files created
99 by mysql_ssl_rsa_setup to enable SSL if no explicit SSL options are
100 given other than --ssl (possibly along with ssl_cipher). If you prefer
101 to designate the files explicitly, invoke clients with the --ssl-ca,
102 --ssl-cert, and --ssl-key options at startup to name the ca.pem,
103 server-cert.pem, and server-key.pem files, respectively.
104 The server also automatically uses the RSA files created by
106 mysql_ssl_rsa_setup to enable RSA if no explicit RSA options are given.
107 If the server is SSL-enabled, clients use SSL by default for the
109 connection. To specify certificate and key files explicitly, use the
110 --ssl-ca, --ssl-cert, and --ssl-key options to name the ca.pem,
111 client-cert.pem, and client-key.pem files, respectively. However, some
112 additional client setup may be required first because
113 mysql_ssl_rsa_setup by default creates those files in the data
114 directory. The permissions for the data directory normally enable
115 access only to the system account that runs the MySQL server, so client
116 programs cannot use files located there. To make the files available,
117 copy them to a directory that is readable (but not writable) by
118 clients:
119 • For local clients, the MySQL installation directory can be used.
121 For example, if the data directory is a subdirectory of the
122 installation directory and your current location is the data
123 directory, you can copy the files like this:
124 cp ca.pem client-cert.pem client-key.pem ..
126 • For remote clients, distribute the files using a secure channel to
128 ensure they are not tampered with during transit.
129 If the SSL files used for a MySQL installation have expired, you can
131 use mysql_ssl_rsa_setup to create new ones:
132 1. Stop the server.
134 2. Rename or remove the existing SSL files. You may wish to make a
136 backup of them first. (The RSA files do not expire, so you need not
137 remove them. mysql_ssl_rsa_setup can see that they exist and does
138 not overwrite them.)
139 3. Run mysql_ssl_rsa_setup with the --datadir option to specify where
141 to create the new files.
142 4. Restart the server.
144 mysql_ssl_rsa_setup supports the following command-line options, which
146 can be specified on the command line or in the [mysql_ssl_rsa_setup]
147 and [mysqld] groups of an option file. For information about option
148 files used by MySQL programs, see Section 4.2.2.2, “Using Option
149 Files”.
150 • --help, ? Display a help message and exit.
152 • --datadir=dir_name The path to the directory that
154 mysql_ssl_rsa_setup should check for default SSL and RSA files and
155 in which it should create files if they are missing. The default is
156 the compiled-in data directory.
157 • --suffix=str The suffix for the Common Name attribute in X.509
159 certificates. The suffix value is limited to 17 characters. The
160 default is based on the MySQL version number.
161 • --uid=name, -v The name of the user who should be the owner of any
163 created files. The value is a user name, not a numeric user ID. In
164 the absence of this option, files created by mysql_ssl_rsa_setup
165 are owned by the user who executes it. This option is valid only if
166 you execute the program as root on a system that supports the
167 chown() system call.
168 • --verbose, -v Verbose mode. Produce more output about what the
170 program does. For example, the program shows the openssl commands
171 it runs, and produces output to indicate whether it skips SSL or
172 RSA file creation because some default file already exists.
173 • --version, -V Display version information and exit.
175
177 Copyright © 1997, 2023, Oracle and/or its affiliates.
178 This documentation is free software; you can redistribute it and/or
180 modify it only under the terms of the GNU General Public License as
181 published by the Free Software Foundation; version 2 of the License.
182 This documentation is distributed in the hope that it will be useful,
184 but WITHOUT ANY WARRANTY; without even the implied warranty of
185 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
186 General Public License for more details.
187 You should have received a copy of the GNU General Public License along
189 with the program; if not, write to the Free Software Foundation, Inc.,
190 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or see
191 http://www.gnu.org/licenses/.
192
195 For more information, please refer to the MySQL Reference Manual, which
196 may already be installed locally and which is also available online at
197 http://dev.mysql.com/doc/.
198
200 Oracle Corporation (http://dev.mysql.com/).
201MySQL 8.0 08/31/2023 MYSQL_SSL_RSA_SETUP(1)