Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

Does setting MASTER_SSL to 1 in change master ensure encryption without specifying options MASTER_SSL_CA, MASTER_SSL_CAPATH, MASTER_SSL_CERT, MASTER_SSL_KEY ?

After setting MASTER_SSL to 1, show slave status says Master_SSL_Allowed: yes, but does that ensure the transferred data will be encrypted?

 Master_SSL_Allowed: Yes
 Master_SSL_CA_File:
 Master_SSL_CA_Path:
    Master_SSL_Cert:
  Master_SSL_Cipher:
     Master_SSL_Key:

Thanks!

share|improve this question
    
I should have user proper keywords to search before posting.. dba.stackexchange.com/questions/37673/… –  MySqlUser Jul 25 '13 at 19:43
    
well if you found it now and it's cleared for you, you could answer it yourself and accept that answer ;-) –  cptPH Jul 25 '13 at 20:00
add comment

1 Answer

No, it does not. What you did only enables SSL for MySQL Replication.

There are two ways to get the encryption rolling

OPTION #1

Specify the SSL Certificates in my.cnf

[client]
ssl-ca=cacert.pem
ssl-cert=client-cert.pem
ssl-key=client-key.pem

Then, your CHANGE MASTER TO command works fine.

OPTION #2

Specify the SSL Certificates in your CHANGE MASTER TO command

CHANGE MASTER TO
MASTER_HOST='master_ip',
MASTER_USER='repluser',
MASTER_PASSWORD='replpass',
MASTER_SSL=1,
MASTER_SSL_CA = 'ca_file_name',
MASTER_SSL_CAPATH = 'ca_directory_name',
MASTER_SSL_CERT = 'cert_file_name',
MASTER_SSL_KEY = 'key_file_name';

EPILOGUE

With either option, you must have ssl in my.cnf and enabled beforehand.

For more information, see the MySQL Documentation with reference to SSL

Please see my post on having REQUIRE SUBJECT and the replication user defined with REQUIRE SSL

Even, if ssl was defined and you ran your initial CHANGE MASTER TO command, wouldn't the encryption algorithm be the same every time? Wouldn't the slight random chance of cracking the encryption exist if the same default encryption were used by default?

In light of this, it's best to declare the certificates.

share|improve this answer
    
My question was for enabling SSL for MySQL Replication. Sorry for that being clear! –  MySqlUser Jul 25 '13 at 20:12
    
@RolandoMySQLDBA as I was researching this today (for reasons unrelated to this question), I came to the conclusion that there is absolutely no way to be absolutely certain that replication is actually using the configured SSL unless you REQUIRE SSL on the replication user's account on the master, because to "enable" SSL on the slave does not appear to "mandate" SSL be used by the slave, and SHOW SLAVE STATUS gives no hints as to whether the connection is encrypted or what cipher is being used. Do you concur? –  Michael - sqlbot Jul 25 '13 at 20:57
    
@Michael-sqlbot Yes, I concur. This is why made the worse-case assumption towards the end of my question, which would not make sense. Docs say two ways to get encryption. Both ways actually require the certificate files. –  RolandoMySQLDBA Jul 26 '13 at 1:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.