1

I need to cryptography a connection between client and server.

This is config in my server

MariaDB [(none)]> show variables like "%ssl%";
+---------------------+----------------------------+
| Variable_name       | Value                      |
+---------------------+----------------------------+
| have_openssl        | YES                        |
| have_ssl            | DISABLED                   |
| ssl_ca              |                            |
| ssl_capath          |                            |
| ssl_cert            |                            |
| ssl_cipher          |                            |
| ssl_crl             |                            |
| ssl_crlpath         |                            |
| ssl_key             |                            |
| version_ssl_library | OpenSSL 1.0.1t  3 May 2016 |
+---------------------+----------------------------+

Its possible to authenticate with SSL without verify the client certificate with server CA (ssl_ca) ?

2

Its possible to authenticate with SSL without verify the client certificate with server CA (ssl_ca) ?

No, you will need to create a CA, generate a Certificate Generation Request (CSR), then generate a client certificate from the CA. Both sides of the connection will need the client cert and the CA.

You can reuse the same client certificate for all clients. Or, when creating the user you can use REQUIRE CN= to enforce the user to connect with a specific certificate (this requires a different step when generating the client cert).

  • I recommend using passwords as well for authentication
  • Pay attention to the expiration date of your CA. Updating the CA or client certs requires a restart of MySQL
  • You can have more than one CA in your ssl_ca file to allow for a transition period if you are required to rotate CAs.
  • The CN for your CA cannot be the same as your client cert. You will tear your hair out trying to figure out what you did wrong if you do this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.