I want to enable an SSL connection to my database. I've created SSL certificates and so on, however SSL remains disabled:

mysql> show variables like '%ssl%';
| Variable_name | Value                              |
| have_openssl  | DISABLED                           |
| have_ssl      | DISABLED                           |
| ssl_ca        | C:/Users/Krzysztof/ca-cert.pem     |
| ssl_capath    |                                    |
| ssl_cert      | C:/Users/Krzysztof/server-cert.pem |
| ssl_cipher    |                                    |
| ssl_key       | C:/Users/Krzysztof/server-key.pem  |

What am I missing?

I'm using Windows 7.

5 Answers 5


You need to check to make sure the user indeed has the ssl field loaded.

Run this query;

(SELECT user,host FROM mysql.user WHERE ssl_type IS NOT NULL) A
(SELECT user,host FROM mysql.user WHERE ssl_cipher IS NOT NULL) B
USING (user,host);

If nothing comes back, then look the user using

(SELECT user,host FROM mysql.user WHERE ssl_type IS NOT NULL) A
(SELECT user,host FROM mysql.user WHERE ssl_cipher IS NOT NULL);

If nothing comes back from this second query, that means no user in mysql.user has ssl_type and ssl_cipher filled in properly.

Another thing you can investigate is this:

Did you add this to my.ini ?


If you didn't, please do so and run this

C:\> net stop mysql
C:\> net start mysql
  • do you mean [mysqld] instead of [mysql]?
    – knocte
    Jun 14, 2016 at 13:50

Did you start your mysql server with the --ssl option?

See the documentation of mysql for more info.

  • tried this: mysql --ssl-ca=ca-cert.pem\--ssl-cert=server-cert.pem\--ssl-key=server-key.pem -uroot -proot but it didn't work either :( i also try to connect using other user (created with GRANT and REQUIRE SSL) but it always says that access is denied...
    – Krzysztof Borkowski
    Jan 22, 2012 at 21:05
  • this didn't help because in theory when you use any of the --ssl options to specify the cert/key files, you're implying SSL to be enabled already
    – knocte
    Jun 15, 2016 at 7:06

Thanx @RolandoMySQLDBA and @dgw for help! ;) in meantime i created certificates again, validated them, then i re-installed all MySQL products on computer, added new user with this:

GRANT ALL PRIVILEGES ON *.* TO 'ssluser'@'localhost' IDENTIFIED BY 'ssluser' REQUIRE SSL;

and after loging like this:

mysql -ussluser -pssluser -P3306 --ssl-key=

it works :D. But i got another problem - how to connect to MySQL using SSL, via servlet? Without SSL code that worked looked like this:

package test;

import java.io.*;
import java.sql.*;
import javax.servlet.*;
import javax.servlet.http.*;
public class Registration extends HttpServlet{
    private static final long serialVersionUID = 1L;
public void init(ServletConfig config) throws ServletException{
public void doPost(HttpServletRequest req, HttpServletResponse res) 
throws ServletException, IOException{
String connectionURL = "jdbc:mysql://localhost:3306/jsp";
Connection connection=null;
ResultSet rs;
PrintWriter out = res.getWriter();
String firstNamed = req.getParameter("firstName");
String lastNamed = req.getParameter("lastName");
String emaild = req.getParameter("email");
String userNamed = req.getParameter("userName");
String password1d = req.getParameter("password1");
String zipd = req.getParameter("zip");
String auto = "user";
try {
connection = DriverManager.getConnection(connectionURL, "root", "root"); 
String sql = "insert into userprofile values (?,?,?,?,?,?,?)";
PreparedStatement pst = connection.prepareStatement(sql);
pst.setString(1, firstNamed);
pst.setString(2, lastNamed);
pst.setString(3, emaild);
pst.setString(5, password1d);
pst.setString(6, zipd);
pst.setString(7, auto);

int numRowsChanged = pst.executeUpdate();
out.println(" Welcome : ");
out.println(" '"+userNamed+"'");
catch(ClassNotFoundException e){
out.println("Couldn't load database driver: " + e.getMessage());
catch(SQLException e){
out.println("SQLException caught: " + e.getMessage());
catch (Exception e){
finally {

try {
if (connection != null) connection.close();
catch (SQLException ignored){

just, how correct it? i quess that i need to modify connectionURL somehow but i dont know how :(

  • Did you mean this as an edit to your original question? Jan 24, 2012 at 21:01

I have spent 5 days to understand why the variables have_openssl was always set to disable. The reason is that the server can't read the certificates (I don't know why) in every directory I've tried to put that. The only directory that work for me is the one that contain the file my.ini ( C:\programData\mySql ). The solution is to copy the certificates in that directory. That worked for Windows server 2008.

  • I tried this and it didn't help
    – knocte
    Jun 15, 2016 at 7:03

I was having the same problem and I was finding this in the mysql error log:

2016-06-14T14:09:02.742036Z 0 [Warning] Failed to set up SSL because of the following SSL library error: Unable to get private key

After much tinkering, I found the solution, which is to run this openssl command to get a new server key:

openssl rsa -in server-key.pem -out sanitized-server-key.pem

Then use the new key in the ssl-key= setting in my.ini.

The reason for this could be two-folded:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.