I'm using MySQL 5.7 and I want to set up SSL to force the client to use a cert. This cert is a self-signed cert that I generate. I have the cert for both server and client being: - CA - cert - key
Where the CA has the cert for server and client. I then configured the config file (mysqld.conf) to use the cert:
[mysqld]
ssl
ssl-ca=/database/mysql/ssl/ca-cert.pem
ssl-cert=/database/mysql/ssl/master-public.pem
ssl-key=/database/mysql/ssl/master-private.pem
And run the command to enforce it:
GRANT ALL PRIVILEGES ON `database` TO 'user'@'192.168.10.10' IDENTIFIED BY 'password' REQUIRE SSL;
I can see SSL is enabled and it's picking up the right files running the command:
SHOW VARIABLES LIKE '%ssl%';
However, from the client machine (192.168.10.10. in this example) I can connect via command line without specifying any cert and it just connects. I can see the connection is using SSL with:
mysql> \s
SSL: Cipher in use is DHE-RSA-AES256-SHA
But the idea is to allow t he connection only if I use the certs. Is there a way to enforce it to make sure it won't connect without specifying the cert ? So I can configure the application to use it and make sure other applications wouldn't access it.
require_secure_transport
server system variable, which is "off" by default.