Movatterモバイル変換

• Server-Side Startup Configuration for Encrypted Connections

• Client-Side Configuration for Encrypted Connections

• Configuring Encrypted Connections as Mandatory

• Between source and replica servers. SeeSection 16.3.8, “Setting Up Replication to Use Encrypted Connections”.

• Among Group Replication servers. SeeSection 17.6.2, “Group Replication Secure Socket Layer (SSL) Support”.

• By client programs that are based on the MySQL C API. SeeSupport for Encrypted Connections.

On the server side, the--ssl option specifies that the server permits but does not require encrypted connections. This option is enabled by default, so it need not be specified explicitly.

To require that clients connect using encrypted connections, enable therequire_secure_transport system variable. SeeConfiguring Encrypted Connections as Mandatory.

These system variables on the server side specify the certificate and key files the server uses when permitting clients to establish encrypted connections:

For example, to enable the server for encrypted connections, start it with these lines in themy.cnf file, changing the file names as necessary:

[mysqld]ssl_ca=ca.pemssl_cert=server-cert.pemssl_key=server-key.pem

To specify in addition that clients are required to use encrypted connections, enable therequire_secure_transport system variable:

[mysqld]ssl_ca=ca.pemssl_cert=server-cert.pemssl_key=server-key.pemrequire_secure_transport=ON

Each certificate and key system variable names a file in PEM format. Should you need to create the required certificate and key files, seeSection 6.3.3, “Creating SSL and RSA Certificates and Keys”. MySQL servers compiled using OpenSSL can generate missing certificate and key files automatically at startup. SeeSection 6.3.3.1, “Creating SSL and RSA Certificates and Keys using MySQL”. Alternatively, if you have a MySQL source distribution, you can test your setup using the demonstration certificate and key files in itsmysql-test/std_data directory.

The server performs certificate and key file autodiscovery. If no explicit encrypted-connection options are given other than--ssl (possibly along withssl_cipher) to configure encrypted connections, the server attempts to enable encrypted-connection support automatically at startup:

If the server automatically enables encrypted connection support, it writes a note to the error log. If the server discovers that the CA certificate is self-signed, it writes a warning to the error log. (The certificate is self-signed if created automatically by the server or manually usingmysql_ssl_rsa_setup.)

MySQL also provides these system variables for server-side encrypted-connection control:

For a complete list of client options related to establishment of encrypted connections, seeCommand Options for Encrypted Connections.

By default, MySQL client programs attempt to establish an encrypted connection if the server supports encrypted connections, with further control available through the--ssl-mode option:

Attempts to establish an unencrypted connection fail if therequire_secure_transport system variable is enabled on the server side to cause the server to require encrypted connections. SeeConfiguring Encrypted Connections as Mandatory.

The following options on the client side identify the certificate and key files clients use when establishing encrypted connections to the server. They are similar to thessl_ca,ssl_cert, andssl_key system variables used on the server side, but--ssl-cert and--ssl-key identify the client public and private key:

For additional security relative to that provided by the default encryption, clients can supply a CA certificate matching the one used by the server and enable host name identity verification. In this way, the server and client place their trust in the same CA certificate and the client verifies that the host to which it connected is the one intended:

MySQL also provides these options for client-side encrypted-connection control:

Depending on the encryption requirements of the MySQL account used by a client, the client may be required to specify certain options to connect using encryption to the MySQL server.

Suppose that you want to connect using an account that has no special encryption requirements or that was created using aCREATE USER statement that included theREQUIRE SSL clause. Assuming that the server supports encrypted connections, a client can connect using encryption with no--ssl-mode option or with an explicit--ssl-mode=PREFERRED option:

mysql

Or:

mysql --ssl-mode=PREFERRED

For an account created with aREQUIRE SSL clause, the connection attempt fails if an encrypted connection cannot be established. For an account with no special encryption requirements, the attempt falls back to an unencrypted connection if an encrypted connection cannot be established. To prevent fallback and fail if an encrypted connection cannot be obtained, connect like this:

mysql --ssl-mode=REQUIRED

If the account has more stringent security requirements, other options must be specified to establish an encrypted connection:

For additional information about theREQUIRE clause, seeSection 13.7.1.2, “CREATE USER Statement”.

MySQL servers can generate client certificate and key files that clients can use to connect to MySQL server instances. SeeSection 6.3.3, “Creating SSL and RSA Certificates and Keys”.

To prevent use of encryption and override other--ssl-xxx options, invoke the client program with--ssl-mode=DISABLED:

mysql --ssl-mode=DISABLED

To determine whether the current connection with the server uses encryption, check the session value of theSsl_cipher status variable. If the value is empty, the connection is not encrypted. Otherwise, the connection is encrypted and the value indicates the encryption cipher. For example:

mysql> SHOW SESSION STATUS LIKE 'Ssl_cipher';+---------------+---------------------------+| Variable_name | Value                     |+---------------+---------------------------+| Ssl_cipher    | DHE-RSA-AES128-GCM-SHA256 |+---------------+---------------------------+

For themysql client, an alternative is to use theSTATUS or\s command and check theSSL line:

mysql> \s...SSL: Not in use...

Or:

mysql> \s...SSL: Cipher in use is DHE-RSA-AES128-GCM-SHA256...

For some MySQL deployments it may be not only desirable but mandatory to use encrypted connections (for example, to satisfy regulatory requirements). This section discusses configuration settings that enable you to do this. These levels of control are available:

To require that clients connect using encrypted connections, enable therequire_secure_transport system variable. For example, put these lines in the servermy.cnf file:

[mysqld]require_secure_transport=ON

Withrequire_secure_transport enabled, client connections to the server are required to use some form of secure transport, and the server permits only TCP/IP connections that use SSL, or connections that use a socket file (on Unix) or shared memory (on Windows). The server rejects nonsecure connection attempts, which fail with anER_SECURE_TRANSPORT_REQUIRED error.

To invoke a client program such that it requires an encrypted connection whether or not the server requires encryption, use an--ssl-mode option value ofREQUIRED,VERIFY_CA, orVERIFY_IDENTITY. For example:

mysql --ssl-mode=REQUIREDmysqldump --ssl-mode=VERIFY_CAmysqladmin --ssl-mode=VERIFY_IDENTITY

To configure a MySQL account to be usable only over encrypted connections, include aREQUIRE clause in theCREATE USER statement that creates the account, specifying in that clause the encryption characteristics you require. For example, to require an encrypted connection and the use of a valid X.509 certificate, useREQUIRE X509:

CREATE USER 'jeffrey'@'localhost' REQUIRE X509;

For additional information about theREQUIRE clause, seeSection 13.7.1.2, “CREATE USER Statement”.

To modify existing accounts that have no encryption requirements, use theALTER USER statement.