1

We're using MySQL 5.7.22. Each time I restart MySQL it creates a set of SSL files ( ca-key.pem etc) in the datadir.
The problem is that I already have these files on the server, in /etc/mysql/ssl.

Running show global variables like '%ssl%' shows me that it is looking at the correct files in /etc/mysql/ssl, but it still creates the new ones in the datadir.

I can see that there is an option to auto_generate_certs=off but when I add this to my.cnf file, it just comes up as unknown variable and MySQL won't start

Is there a way to prevent it from creating these certificates every time I restart the database?

1

From the documentation page you linked to:

This variable is available if the server was compiled using OpenSSL

It sounds like you're using the standard MySQL community edition binary distribution, which is not compiled with OpenSSL, and this is why you're getting the error message when you try to start up with auto_generate_certs=OFF.

See OpenSSL vs yaSSL for details.

See also documentation for the ssl_capath variable, which is what I assume you looked at to deduce that MySQL was looking for your certificate files in /etc/mysql/ssl:

MySQL distributions compiled using OpenSSL support the --ssl-capath option (see Section 6.4.4, “OpenSSL Versus yaSSL”). Distributions compiled using yaSSL do not because yaSSL does not look in any directory and does not follow a chained certificate tree. yaSSL requires that all components of the CA certificate tree be contained within a single CA certificate tree and that each certificate in the file has a unique SubjectName value. To work around this yaSSL limitation, concatenate the individual certificate files comprising the certificate tree into a new file and specify that file as the value of the --ssl-ca option.

  • OK cheers, I am indeed using the community edition with yaSSL. So essentially what we are saying is that the only way to stop this happening is to "concatenate the individual certificate files comprising the certificate tree into a new file". – IGGt May 11 '18 at 9:37
  • @IGGt Yes, that seems to be the case. Afraid I don't have any experience with this. MariaDB doesn't have these restrictions, just saying ... – dbdemon May 11 '18 at 9:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.