MySQL / MariaDB SSL Connection without verify CA

Question

I need to cryptography a connection between client and server.

This is config in my server

MariaDB [(none)]> show variables like "%ssl%";
+---------------------+----------------------------+
| Variable_name       | Value                      |
+---------------------+----------------------------+
| have_openssl        | YES                        |
| have_ssl            | DISABLED                   |
| ssl_ca              |                            |
| ssl_capath          |                            |
| ssl_cert            |                            |
| ssl_cipher          |                            |
| ssl_crl             |                            |
| ssl_crlpath         |                            |
| ssl_key             |                            |
| version_ssl_library | OpenSSL 1.0.1t  3 May 2016 |
+---------------------+----------------------------+

Its possible to authenticate with SSL without verify the client certificate with server CA (ssl_ca) ?

Answer 1

Its possible to authenticate with SSL without verify the client certificate with server CA (ssl_ca) ?

No, you will need to create a CA, generate a Certificate Generation Request (CSR), then generate a client certificate from the CA. Both sides of the connection will need the client cert and the CA.

You can reuse the same client certificate for all clients. Or, when creating the user you can use REQUIRE CN= to enforce the user to connect with a specific certificate (this requires a different step when generating the client cert).

• I recommend using passwords as well for authentication
• Pay attention to the expiration date of your CA. Updating the CA or client certs requires a restart of MySQL
• You can have more than one CA in your ssl_ca file to allow for a transition period if you are required to rotate CAs.
• The CN for your CA cannot be the same as your client cert. You will tear your hair out trying to figure out what you did wrong if you do this.

Answer 2

Yes you can, at least with MariaDB. This scenario is explicitly explained in the documentation. You just need to specify the use of SSL without actually providing path to a CA file, e.g. in a configuration file,

[client-mariadb]
...
ssl

Of course, the more security, the securier, but I find this possibility still useful to avoid having password in clear flying around while requiring no change for the clients.