5

Getting an error while trying to enable encryption:

[ERROR] SSL error: Unable to get private key from '/etc/mysql/ssl/nginx.key'
[Warning] Failed to set up SSL because of the following SSL library error: Unable to get private key

/etc/mysql/conf.d/encrypt.cnf:

[mysqld]
ssl-ca=/etc/mysql/ssl/nginx.ca
ssl-cert=/etc/mysql/ssl/nginx.crt
ssl-key=/etc/mysql/ssl/nginx.key

The key is generated like that:

openssl req -newkey rsa:4096 -nodes -keyout nginx.key -subj "/C=US/ST=California/L=Sacramento/O=MyOrg/OU=MyDev/CN=MyApp"

The openssl checks it fine.

I've tried to change permissions, owners, file names, moving to different directories, disabling SELinux (it's already disabled), looking at AppArmor logs (it doesn't block it), changing 'BEGIN/END PRIVATE KEY' to 'BEGIN/END RSA PRIVATE KEY'.

What's wrong with it?

9

Ok, apparently just changing 'BEGIN PRIVATE KEY' to 'BEGIN RSA PRIVATE KEY' isn't enough.

It must be properly converted from PKCS#8 to PKCS#1 Reference

openssl rsa -in /etc/mysql/ssl/nginx.key -out ~/nginx.key.rsa
  • 1
    Why did I just search the Internet for an hour for this...thank you. – BaseZen Jun 1 '18 at 22:09
  • Mine needed this because it was originally generated by LetsEncrypt for my website. But Apache needed no conversion. – BaseZen Jun 1 '18 at 22:16
1

As a consolidation of my false leads that helped others:

  • POSIX mode bits and file owner: The mysql user must have read access to all SSL files via user or group privileges. This may mean chown mysql *.pem or adding ssl-private to mysql's groups. (https://serverfault.com/questions/417390/cannot-setup-mysql-ssl-unable-to-read-certificate)

  • AppArmor can cut off file access. You need something like /etc/mysql/** in /etc/apparmor.d/usr.sbin/mysqld. Check /var/log/kern.log and consider aa-complain /usr/sbin/mysqld to get errors rather than denials.(https://forums.mysql.com/read.php?26,393495,393636#msg-393636)

  • Malformatted file contents. SSL library is very bad at complaining accurately. Ensure the full key set works on, say, a web site.

  • The file is missing entirely. Again, in the error message there is no distinction made.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.