3

I am following word by word of http://dev.mysql.com/doc/refman/5.0/en/creating-ssl-certs.html for creating SSL certificates to setup SSL enable replication but it is not working for me. Steps which I am following:

  1. Using above reference I have created all required certificates in /var/opt/mysql_certs/
  2. Changed the ownership of all the certificates chown -R mysql:mysql /var/opt/mysql_certs

  3. Then I edited my /etc/my.conf and put these 3 lines in mysqld section:

    ssl-ca=/var/opt/mysql_certs/ca-cert.pem
    ssl-cert=/var/opt/mysql_certs/server-cert.pem
    ssl-key=/var/opt/mysql_certs/server-key.pem
    
  4. Lastly I am restarting mysqld with /etc/init.d/restart mysqld. But, I am getting following errors:

    [Warning]: Failed to setup SSL`
    [Warning] SSL error: SSL_CTX_set_default_verify_paths failed
    

FYI: OS is centOS 6.

3

I recently solved this issue on my own system and it turned out to be SELinux blocking the reads for the certificates. I fixed my problem by running a restorecon -v /path/to/certs/* but it could also be solved by disabling selinux by running setenforce 0 or by editing the /etc/selinux/config file and setting 'SELINUX=DISABLED'.

If you haven't disabled SELinux already that is.

|improve this answer|||||
  • Please mark your own answer as correct (I know that you have to wait a certain time). This will hopefully help others with the same problem in future, thanks. – Vérace Apr 5 '15 at 11:00
  • If SELINUX is disabled and the result is the same, what can be done? I am trying for several days and still without success. – Iskren Mihaylov Apr 23 '15 at 9:32
  • Have you verified the file permissions? MySQL must be able to read the certificate files. My working setup has the files owned by the mysql user with read permissions for the user only. – InfernoTK Apr 24 '15 at 15:52
  • I really dislike the generic "disable SELinux" answer I see so often. Folks should learn how to use SELinux, not turn it off every time it gets in the way. (I'm not suggesting you are doing that, but it's becoming a pet peeve of mine every time I see it as a possible solution). – woot Jun 6 '17 at 18:46
  • Personally, I leave SELinux running, and I agree that one should. That said, I have wished I didn't so many times because of hard to debug issues like this! – BuvinJ Apr 10 '18 at 22:16
2

As pointed out by @InfernoTK in a comment, the issue can be POSIX permissions. Make sure the user that is running the MySQL daemon (the user is called mysql often) has read access to all the files specified in your my.cnf, for the SSL options (ssl-ca, ssl-cert, ssl-key).

An easy way to test is to run:

sudo -u mysql cat /path/to/ssl/cert.pem

And repeat for the key & CA cert.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.