1

I am having problems with enabling SSL in MariaDB running on Synology NAS (DSM version 6.0) using self signed certificates. I have modified the my.cnf file to point to certificate files and the DB seems to be loading the .cnf file ok, the ssl variables are listing the corect location of the cert files (verified over phpmyadmin) however it still says that ssl is diabled (variable have_ssl=disabled) and the DB is refusing incoming ssl connections. This is my first time working with Synology NAS so I have no idea what to try, so any help or suggestion is welcome. Thank you in advance.

Edit: I tried contacting synology tech support but got answer that they do not provide any support for mariadb beyond just installing it.

1

Please, check the following configuration files and variables:

File: /etc/mysql/my.cnf

[client]
...
ssl-ca=/var/lib/mysql/ca.pem
ssl-cert=/var/lib/mysql/client-cert.pem
ssl-key=/var/lib/mysql/client-key.pem
ssl-verify-server-cert
...

[mysqld]
...
ssl
ssl-ca=/var/lib/mysql/ca.pem
ssl-cert=/var/lib/mysql/server-cert.pem
ssl-key=/var/lib/mysql/server-key.pem
...

File: /etc/hosts

127.0.0.1 localhost CNSERVER

MariaDB Command-Line:

$ mysql -u root -p -h CNSERVER
Enter password: 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 1
Server version: 10.1.14-MariaDB-1~xenial mariadb.org binary distribution

Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> SHOW VARIABLES LIKE '%ssl%';
+---------------------+---------------------------------+
| Variable_name       | Value                           |
+---------------------+---------------------------------+
| have_openssl        | YES                             |
| have_ssl            | YES                             |
| ssl_ca              | /var/lib/mysql/ca.pem           |
| ssl_capath          |                                 |
| ssl_cert            | /var/lib/mysql/server-cert.pem  |
| ssl_cipher          |                                 |
| ssl_crl             |                                 |
| ssl_crlpath         |                                 |
| ssl_key             | /var/lib/mysql/server-key.pem   |
| version_ssl_library | OpenSSL 1.0.2g-fips  1 Mar 2016 |
+---------------------+---------------------------------+
10 rows in set (0.00 sec)

MariaDB [(none)]> SHOW SESSION STATUS LIKE '%Ssl_version%';
+---------------+---------+
| Variable_name | Value   |
+---------------+---------+
| Ssl_version   | TLSv1.2 |
+---------------+---------+
1 row in set (0.00 sec)
| improve this answer | |
  • Checked, verified and everything seems ok except for the lines have_openssl and have_ssl which both have value DISABLED. – BrackenAlistair Jun 27 '16 at 15:51
  • @BrackenAlistair: Check Secure Connections Overview. – wchiquito Jun 27 '16 at 18:38
  • Tried the command ldd which mysqld | grep ssl, however synology does not know the command ldd. – BrackenAlistair Jul 3 '16 at 20:31
0

Have you started the mysqld daemon with the appropriate --ssl-xxx options? There's a system variable called have_ssl which deals with this.

You say it's DISABLED, so that might be a solution.

According to the documentation:

•   `have_ssl` 

YES if mysqld supports SSL connections, NO if not. DISABLED 
indicates that the server was compiled with SSL support, but 
was not started with the appropriate --ssl-xxx options. For more
information, see Section 6.4.2, "Building MySQL with Support for 
Secure Connections”.

The "Building MySQL with Support for Secure Connections” link is available here.

| improve this answer | |
  • I belive so, the --ssl-xxx options are all set and the db is aware of them (as mentioned above when listing all ssl variables over phpmyadmin I can see the values set in my.cnf file). – BrackenAlistair Jun 26 '16 at 8:02
0

You need to install the certificates under /etc/. Create a directory mysql-ssl, and put the files in there.

I had the same issues and I've solved that way. Also on MariaDB name the certificates with different answers otherwise it won't work.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.