By default mysql server creates these 6 certificates in
-rw------- 1 mysql mysql 1676 Aug 3 00:16 ca-key.pem -rw-r--r-- 1 mysql mysql 1112 Aug 3 00:16 ca.pem -rw-r--r-- 1 mysql mysql 1112 Aug 3 00:16 client-cert.pem -rw------- 1 mysql mysql 1676 Aug 3 00:16 client-key.pem -rw------- 1 mysql mysql 1680 Aug 3 00:16 private_key.pem -rw-r--r-- 1 mysql mysql 452 Aug 3 00:16 public_key.pem -rw-r--r-- 1 root root 1172 Aug 6 12:20 server-cert.pem -rw------- 1 mysql mysql 1676 Aug 3 00:16 server-key.pem
As mentioned in https://dev.mysql.com/doc/mysql-security-excerpt/5.7/en/creating-ssl-rsa-files-using-mysql.html ,
private_key.pem are used in:
These key-pair files enable secure password exchange using RSA over unencrypted connections for accounts authenticated by the
If I understand correctly, the other 6 certificates are used for mutual tls verification.
I tested it with DataGrip and there are 3 options:
Verifa CA and
Full Verification. (commandline interface e.g.
mysqlsh has corresponding options)
Requirehas nothing to with certificates, it starts a tls encryption with server as ordinary https does.
Verify CAverifies the
ca.pem, which you get from the server
Full Verificationis the client verifying not only the
ca.pem, but also
( you need to re-generate a
server-cert.pemfor this work. Because the auto-generated
Subject:field doesn't match the server ip/domain)
None of the options reuire specifying client cert and key. So what's the usage of proving
client-cert.pem in the client? I don't find an option like "verify the client" in mysql server. So it's merely one way verification and client certs are completely useless? I don't get it.