mysql_ssl_rsa_setup(1)

1MYSQL_SSL_RSA_SETUP(1)       MySQL Database System      MYSQL_SSL_RSA_SETUP(1)
2
3
4

NAME

6       mysql_ssl_rsa_setup - create SSL/RSA files
7

SYNOPSIS

9       mysql_ssl_rsa_setup [options]
10

DESCRIPTION

12       This program creates the SSL certificate and key files and RSA key-pair
13       files required to support secure connections using SSL and secure
14       password exchange using RSA over unencrypted connections, if those
15       files are missing.  mysql_ssl_rsa_setup can also be used to create new
16       SSL files if the existing ones have expired.
17
18           Note
19           mysql_ssl_rsa_setup uses the openssl command, so its use is
20           contingent on having OpenSSL installed on your machine.
21
22           Another way to generate SSL and RSA files, for MySQL distributions
23           compiled using OpenSSL, is to have the server generate them
24           automatically. See Section 6.4.3.1, “Creating SSL and RSA
25           Certificates and Keys using MySQL”.
26
27           Important
28           mysql_ssl_rsa_setup helps lower the barrier to using SSL by making
29           it easier to generate the required files. However, certificates
30           generated by mysql_ssl_rsa_setup are self-signed, which is not very
31           secure. After you gain experience using the files created by
32           mysql_ssl_rsa_setup, consider obtaining a CA certificate from a
33           registered certificate authority.
34
35       Invoke mysql_ssl_rsa_setup like this:
36
37           shell> mysql_ssl_rsa_setup [options]
38
39       Typical options are --datadir to specify where to create the files, and
40       --verbose to see the openssl commands that mysql_ssl_rsa_setup
41       executes.
42
43       mysql_ssl_rsa_setup attempts to create SSL and RSA files using a
44       default set of file names. It works as follows:
45
46        1. mysql_ssl_rsa_setup checks for the openssl binary at the locations
47           specified by the PATH environment variable. If openssl is not
48           found, mysql_ssl_rsa_setup does nothing. If openssl is present,
49           mysql_ssl_rsa_setup looks for default SSL and RSA files in the
50           MySQL data directory specified by the --datadir option, or the
51           compiled-in data directory if the --datadir option is not given.
52
53        2. mysql_ssl_rsa_setup checks the data directory for SSL files with
54           the following names:
55
56               ca.pem
57               server-cert.pem
58               server-key.pem
59
60        3. If any of those files are present, mysql_ssl_rsa_setup creates no
61           SSL files. Otherwise, it invokes openssl to create them, plus some
62           additional files:
63
64               ca.pem               Self-signed CA certificate
65               ca-key.pem           CA private key
66               server-cert.pem      Server certificate
67               server-key.pem       Server private key
68               client-cert.pem      Client certificate
69               client-key.pem       Client private key
70
71           These files enable secure client connections using SSL; see
72           Section 6.4.1, “Configuring MySQL to Use Encrypted Connections”.
73
74        4. mysql_ssl_rsa_setup checks the data directory for RSA files with
75           the following names:
76
77               private_key.pem      Private member of private/public key pair
78               public_key.pem       Public member of private/public key pair
79
80        5. If any of these files are present, mysql_ssl_rsa_setup creates no
81           RSA files. Otherwise, it invokes openssl to create them. These
82           files enable secure password exchange using RSA over unencrypted
83           connections for accounts authenticated by the sha256_password or
84           caching_sha2_password plugin; see Section 6.5.1.2, “SHA-256
85           Pluggable Authentication”, and Section 6.5.1.3, “Caching SHA-2
86           Pluggable Authentication”.
87
88       For information about the characteristics of files created by
89       mysql_ssl_rsa_setup, see Section 6.4.3.1, “Creating SSL and RSA
90       Certificates and Keys using MySQL”.
91
92       At startup, the MySQL server automatically uses the SSL files created
93       by mysql_ssl_rsa_setup to enable SSL if no explicit SSL options are
94       given other than --ssl (possibly along with --ssl-cipher). If you
95       prefer to designate the files explicitly, invoke clients with the
96       --ssl-ca, --ssl-cert, and --ssl-key options at startup to name the
97       ca.pem, server-cert.pem, and server-key.pem files, respectively.
98
99       The server also automatically uses the RSA files created by
100       mysql_ssl_rsa_setup to enable RSA if no explicit RSA options are given.
101
102       If the server is SSL-enabled, clients use SSL by default for the
103       connection. To specify certificate and key files explicitly, use the
104       --ssl-ca, --ssl-cert, and --ssl-key options to name the ca.pem,
105       client-cert.pem, and client-key.pem files, respectively. However, some
106       additional client setup may be required first because
107       mysql_ssl_rsa_setup by default creates those files in the data
108       directory. The permissions for the data directory normally enable
109       access only to the system account that runs the MySQL server, so client
110       programs cannot use files located there. To make the files available,
111       copy them to a directory that is readable (but not writable) by
112       clients:
113
114       ·   For local clients, the MySQL installation directory can be used.
115           For example, if the data directory is a subdirectory of the
116           installation directory and your current location is the data
117           directory, you can copy the files like this:
118
119               cp ca.pem client-cert.pem client-key.pem ..
120
121       ·   For remote clients, distribute the files using a secure channel to
122           ensure they are not tampered with during transit.
123
124       If the SSL files used for a MySQL installation have expired, you can
125       use mysql_ssl_rsa_setup to create new ones:
126
127        1. Stop the server.
128
129        2. Rename or remove the existing SSL files. You may wish to make a
130           backup of them first. (The RSA files do not expire, so you need not
131           remove them.  mysql_ssl_rsa_setup will see that they exist and not
132           overwrite them.)
133
134        3. Run mysql_ssl_rsa_setup with the --datadir option to specify where
135           to create the new files.
136
137        4. Restart the server.
138
139       mysql_ssl_rsa_setup supports the following command-line options, which
140       can be specified on the command line or in the [mysql_ssl_rsa_setup]
141       and [mysqld] groups of an option file. For information about option
142       files used by MySQL programs, see Section 4.2.7, “Using Option Files”.
143
144       ·   --help, ?
145
146           Display a help message and exit.
147
148       ·   --datadir=dir_name
149
150           The path to the directory that mysql_ssl_rsa_setup should check for
151           default SSL and RSA files and in which it should create files if
152           they are missing. The default is the compiled-in data directory.
153
154       ·   --suffix=str
155
156           The suffix for the Common Name attribute in X.509 certificates. The
157           suffix value is limited to 17 characters. The default is based on
158           the MySQL version number.
159
160       ·   --uid=name, -v
161
162           The name of the user who should be the owner of any created files.
163           The value is a user name, not a numeric user ID. In the absence of
164           this option, files created by mysql_ssl_rsa_setup are owned by the
165           user who executes it. This option is valid only if you execute the
166           program as root on a system that supports the chown() system call.
167
168       ·   --verbose, -v
169
170           Verbose mode. Produce more output about what the program does. For
171           example, the program shows the openssl commands it runs, and
172           produces output to indicate whether it skips SSL or RSA file
173           creation because some default file already exists.
174
175       ·   --version, -V
176
177           Display version information and exit.
178

COPYRIGHT

180       Copyright © 1997, 2019, Oracle and/or its affiliates. All rights
181       reserved.
182
183       This documentation is free software; you can redistribute it and/or
184       modify it only under the terms of the GNU General Public License as
185       published by the Free Software Foundation; version 2 of the License.
186
187       This documentation is distributed in the hope that it will be useful,
188       but WITHOUT ANY WARRANTY; without even the implied warranty of
189       MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
190       General Public License for more details.
191
192       You should have received a copy of the GNU General Public License along
193       with the program; if not, write to the Free Software Foundation, Inc.,
194       51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or see
195       http://www.gnu.org/licenses/.
196
197

AUTHOR

204       Oracle Corporation (http://dev.mysql.com/).
205
206
207
208MySQL 8.0                         02/20/2019            MYSQL_SSL_RSA_SETUP(1)

NAME

SYNOPSIS

DESCRIPTION

COPYRIGHT

SEE ALSO

AUTHOR