Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to enable an SSL connection to my database. I've created SSL certificates and so on, however SSL remains disabled:

mysql> show variables like '%ssl%';
| Variable_name | Value                              |
| have_openssl  | DISABLED                           |
| have_ssl      | DISABLED                           |
| ssl_ca        | C:/Users/Krzysztof/ca-cert.pem     |
| ssl_capath    |                                    |
| ssl_cert      | C:/Users/Krzysztof/server-cert.pem |
| ssl_cipher    |                                    |
| ssl_key       | C:/Users/Krzysztof/server-key.pem  |

What am I missing?

I'm using Windows 7.

share|improve this question

migrated from Jan 22 '12 at 21:18

This question came from our site for professional and enthusiast programmers.

You need to check to make sure the user indeed has the ssl field loaded.

Run this query;

(SELECT user,host FROM mysql.user WHERE ssl_type IS NOT NULL) A
(SELECT user,host FROM mysql.user WHERE ssl_cipher IS NOT NULL) B
USING (user,host);

If nothing comes back, then look the user using

(SELECT user,host FROM mysql.user WHERE ssl_type IS NOT NULL) A
(SELECT user,host FROM mysql.user WHERE ssl_cipher IS NOT NULL);

If nothing comes back from this second query, that means no user in mysql.user has ssl_type and ssl_cipher filled in properly.

Another thing you can investigate is this:

Did you add this to my.ini ?


If you didn't, please do so and run this

C:\> net stop mysql
C:\> net start mysql
share|improve this answer
do you mean [mysqld] instead of [mysql]? – knocte Jun 14 at 13:50

Did you start your mysql server with the --ssl option?

See the documentation of mysql for more info.

share|improve this answer
tried this: mysql --ssl-ca=ca-cert.pem\--ssl-cert=server-cert.pem\--ssl-key=server-key.pem -uroot -proot but it didn't work either :( i also try to connect using other user (created with GRANT and REQUIRE SSL) but it always says that access is denied... – Krzysztof Borkowski Jan 22 '12 at 21:05
this didn't help because in theory when you use any of the --ssl options to specify the cert/key files, you're implying SSL to be enabled already – knocte Jun 15 at 7:06

Thanx @RolandoMySQLDBA and @dgw for help! ;) in meantime i created certificates again, validated them, then i re-installed all MySQL products on computer, added new user with this:

GRANT ALL PRIVILEGES ON *.* TO 'ssluser'@'localhost' IDENTIFIED BY 'ssluser' REQUIRE SSL;

and after loging like this:

mysql -ussluser -pssluser -P3306 --ssl-key=

it works :D. But i got another problem - how to connect to MySQL using SSL, via servlet? Without SSL code that worked looked like this:

package test;

import java.sql.*;
import javax.servlet.*;
import javax.servlet.http.*;
public class Registration extends HttpServlet{
    private static final long serialVersionUID = 1L;
public void init(ServletConfig config) throws ServletException{
public void doPost(HttpServletRequest req, HttpServletResponse res) 
throws ServletException, IOException{
String connectionURL = "jdbc:mysql://localhost:3306/jsp";
Connection connection=null;
ResultSet rs;
PrintWriter out = res.getWriter();
String firstNamed = req.getParameter("firstName");
String lastNamed = req.getParameter("lastName");
String emaild = req.getParameter("email");
String userNamed = req.getParameter("userName");
String password1d = req.getParameter("password1");
String zipd = req.getParameter("zip");
String auto = "user";
try {
connection = DriverManager.getConnection(connectionURL, "root", "root"); 
String sql = "insert into userprofile values (?,?,?,?,?,?,?)";
PreparedStatement pst = connection.prepareStatement(sql);
pst.setString(1, firstNamed);
pst.setString(2, lastNamed);
pst.setString(3, emaild);
pst.setString(5, password1d);
pst.setString(6, zipd);
pst.setString(7, auto);

int numRowsChanged = pst.executeUpdate();
out.println(" Welcome : ");
out.println(" '"+userNamed+"'");
catch(ClassNotFoundException e){
out.println("Couldn't load database driver: " + e.getMessage());
catch(SQLException e){
out.println("SQLException caught: " + e.getMessage());
catch (Exception e){
finally {

try {
if (connection != null) connection.close();
catch (SQLException ignored){

just, how correct it? i quess that i need to modify connectionURL somehow but i dont know how :(

share|improve this answer
Did you mean this as an edit to your original question? – Nick Chammas Jan 24 '12 at 21:01

I have spent 5 days to understand why the variables have_openssl was always set to disable. The reason is that the server can't read the certificates (I don't know why) in every directory I've tried to put that. The only directory that work for me is the one that contain the file my.ini ( C:\programData\mySql ). The solution is to copy the certificates in that directory. That worked for Windows server 2008.

share|improve this answer
I tried this and it didn't help – knocte Jun 15 at 7:03

I was having the same problem and I was finding this in the mysql error log:

2016-06-14T14:09:02.742036Z 0 [Warning] Failed to set up SSL because of the following SSL library error: Unable to get private key

After much tinkering, I found the solution, which is to run this openssl command to get a new server key:

openssl rsa -in server-key.pem -out sanitized-server-key.pem

Then use the new key in the ssl-key= setting in my.ini.

The reason for this could be two-folded:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.