29

I have configured my server to allow SSL, and have modified my client ~/.my.cnf so I use SSL:

[client]
ssl
ssl-cipher=DHE-RSA-AES256-SHA
ssl-ca=~/certs/ca-cert.pem

When I log in with my client and view the status, it lists a cipher on the SSL line:

mysql> \s
--------------
SSL:            Cipher in use is DHE-RSA-AES256-SHA

Without installing something like wireshark to verify that the connection is secure, can I assume that I'm connecting via SSL based on this information?

38

From the client, just run status. If this connection is using SSL, you'll get something interesting in the SSL row.

mysql> status
--------------
mysql  Ver 14.14 Distrib 5.5.30, for Linux (x86_64) using readline 5.1

Connection id:      12
Current database:
Current user:       replicator@domU-12-31-39-10-54-BD.compute-1.internal
SSL:            Cipher in use is DHE-RSA-AES256-SHA
Current pager:      stdout
Using outfile:      ''
Using delimiter:    ;
Server version:     5.5.30-log MySQL Community Server (GPL)
Protocol version:   10
Connection:     boston.hugskeep.wstudent.com via TCP/IP
Server characterset:    latin1
Db     characterset:    latin1
Client characterset:    utf8
Conn.  characterset:    utf8
TCP port:       3306
Uptime:         44 min 49 sec

Threads: 2  Questions: 16  Slow queries: 0  Opens: 34  Flush tables: 1  Open tables: 27  Queries per second avg: 0.005
--------------

mysql>

If this connection is not using SSL, you'll get:

SSL:            Not in use

You can also use:

mysql> SHOW STATUS LIKE 'Ssl_cipher';
+---------------+--------------------+
| Variable_name | Value              |
+---------------+--------------------+
| Ssl_cipher    | DHE-RSA-AES256-SHA |
+---------------+--------------------+
1 row in set (0.00 sec)

mysql>

But I think the first is more attractive, and sure easier to type.

| improve this answer | |
  • show status like 'Ssl_version' can also be useful to determine the SSL/TLS protocol version being used. – Joao Costa Feb 13 '19 at 16:54
  • do you know if there's a way to do this for a specific user. not just the current user? - stackoverflow.com/questions/56203365/… – committedandroider May 18 '19 at 22:51
  • 1
    I am not sure this has been changed now. For me even I am not using SSL, it shows SSL: Cipher in use is DHE-RSA-AES256-SHA for me. – Sadee Oct 23 '19 at 14:52
2

This is applicable to mariadb mysql (haven't tried in pure mysql):

mysql -h xxx.xxx.xxx.xxx -u testuser --ssl

'--ssl' will tell you if ssl is enabled, without, it will say 'not in use'

| improve this answer | |
  • 2
    WARNING: --ssl is deprecated and will be removed in a future version. Use --ssl-mode instead. MySQL 5.6.4 – Sadee Oct 23 '19 at 14:53
2

Force SSL per user:

alter user 'my_user'@'%' REQUIRE SSL;
mysql> \s
| improve this answer | |
1

SSL: in status command didn't tell you the connection is using SSL. Clients can disable using SSL from their side. Use "show session status" and find "Ssl_client_connects" to find the number of connections using SSL.

| improve this answer | |
0

MySQL 5.6.4

I am not sure this

SHOW STATUS LIKE 'Ssl_cipher';

has been changed in later versions. For me even if I am not using SSL, it shows SSL: Cipher in use is DHE-RSA-AES256-SHA for me.

You can use following to get confirmed SSL is using or not.

ubuntu@ip-111-22-3-444:~$ mysql -h 111.22.3.444 -u dbuser --ssl-mode=VERIFY_IDENTITY -p
ERROR 2026 (HY000): SSL connection error: CA certificate is required if ssl-mode is VERIFY_CA or VERIFY_IDENTITY
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.