尝试在我的 mariadb-server 上启用 SSL。我已按照官方 mariadb 文档生成 ca-key ca-cert server-key server-cert。我的机器是带有 mariadb 的 debian 9 kvm vps10.1.37
当我SHOW VARIABLES LIKE '%ssl';以 root 身份运行时，我得到以下输出：
+---------------------+--------------------------------+
| Variable_name | Value |
+---------------------+--------------------------------+
| have_openssl | NO |
| have_ssl | DISABLED |
| ssl_ca | /etc/mysql/ssl/ca-cert.pem |
| ssl_capath | |
| ssl_cert | /etc/mysql/ssl/server-cert.pem |
| ssl_cipher | |
| ssl_crl | |
| ssl_crlpath | |
| ssl_key | /etc/mysql/ssl/server-key.pem |
| version_ssl_library | YaSSL 2.4.4 |
+---------------------+--------------------------------+
我尝试过多次重新创建证书，包括使用不同的通用名称。证书安装在/etc/mysql/ssl/
我也尝试过从选项开始，然后添加到配置中。我找不到mysqld与此相关的更多信息，因为我有 YASSL 而不是 openssl，因为 mariadb 现在默认使用 YASSL 进行编译，除非我遗漏了某些东西，而 YASSL 不适用于我的密钥？--sslssl=on
我如何创建证书和密钥：
openssl genrsa 2048 > ca-key.pem
openssl req -new -x509 -nodes -days 365000 \
-key ca-key.pem -out ca-cert.pem
openssl req -newkey rsa:2048 -days 365000 \
-nodes -keyout server-key.pem -out server-req.pem
openssl rsa -in server-key.pem -out server-key.pem
openssl x509 -req -in server-req.pem -days 365000 \
-CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 \
-out server-cert.pem
我的 50-server.cnf 文件：
#
# These groups are read by MariaDB server.
# Use it for options that only the server (but not clients) should see
#
# See the examples of server my.cnf files in /usr/share/mysql/
#
# this is read by the standalone daemon and embedded servers
[server]
# this is only for the mysqld standalone daemon
[mysqld]
#
# * Basic Settings
#
user = mysql
pid-file = /var/run/mysqld/mysqld.pid
socket = /var/run/mysqld/mysqld.sock
port = 3306
basedir = /usr
datadir = /var/lib/mysql
tmpdir = /tmp
lc-messages-dir = /usr/share/mysql
skip-external-locking
# Instead of skip-networking the default is now to listen only on
# localhost which is more compatible and is not less secure.
bind-address = 0.0.0.0
#
# * Fine Tuning
#
key_buffer_size = 16M
max_allowed_packet = 16M
thread_stack = 192K
thread_cache_size = 8
# This replaces the startup script and checks MyISAM tables if needed
# the first time they are touched
myisam_recover_options = BACKUP
#max_connections = 100
#table_cache = 64
#thread_concurrency = 10
#
# * Query Cache Configuration
#
query_cache_limit = 1M
query_cache_size = 16M
#
# * Logging and Replication
#
# Both location gets rotated by the cronjob.
# Be aware that this log type is a performance killer.
# As of 5.1 you can enable the log at runtime!
#general_log_file = /var/log/mysql/mysql.log
#general_log = 1
#
# Error log - should be very few entries.
#
log_error = /var/log/mysql/error.log
#
# Enable the slow query log to see queries with especially long duration
#slow_query_log_file = /var/log/mysql/mariadb-slow.log
#long_query_time = 10
#log_slow_rate_limit = 1000
#log_slow_verbosity = query_plan
#log-queries-not-using-indexes
#
# The following can be used as easy to replay backup logs or for replication.
# note: if you are setting up a replication slave, see README.Debian about
# other settings you may need to change.
#server-id = 1
#log_bin = /var/log/mysql/mysql-bin.log
expire_logs_days = 10
max_binlog_size = 100M
#binlog_do_db = include_database_name
#binlog_ignore_db = exclude_database_name
#
# * InnoDB
#
# InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/.
# Read the manual for more InnoDB related options. There are many!
#
# * Security Features
#
# Read the manual, too, if you want chroot!
# chroot = /var/lib/mysql/
#
# For generating SSL certificates you can use for example the GUI tool "tinyca".
#
# ssl-ca=/etc/mysql/cacert.pem
# ssl-cert=/etc/mysql/server-cert.pem
# ssl-key=/etc/mysql/server-key.pem
#
ssl-ca = /etc/mysql/ssl/ca-cert.pem
ssl-key = /etc/mysql/ssl/server-key.pem
ssl-cert = /etc/mysql/ssl/server-cert.pem
#
# Accept only connections using the latest and most secure TLS protocol version.
# ..when MariaDB is compiled with OpenSSL:
#ssl-cipher=TLSv1.2
# ..when MariaDB is compiled with YaSSL (default in Debian):
ssl=on
#
# * Character sets
#
# MySQL/MariaDB default is Latin1, but in Debian we rather default to the full
# utf8 4-byte character set. See also client.cnf
#
character-set-server = utf8mb4
collation-server = utf8mb4_general_ci
#
# * Unix socket authentication plugin is built-in since 10.0.22-6
#
# Needed so the root database user can authenticate without a password but
# only when running as the unix root user.
#
# Also available for other users if required.
# See https://mariadb.com/kb/en/unix_socket-authentication-plugin/
# this is only for embedded server
[embedded]
# This group is only read by MariaDB servers, not by MySQL.
# If you use the same .cnf file for MySQL and MariaDB,
# you can put MariaDB-only options here
[mariadb]
# This group is only read by MariaDB-10.1 servers.
# If you use the same .cnf file for MariaDB of different versions,
# use this group for options that older servers don't understand
[mariadb-10.1]
答案1
经过几个小时的折腾，我发现mysql无法读取密钥文件。我将文件组设置为mysql。
chown -R mysql:mysql /etc/mysql/ssl/
答案2
在 RedHat 家族中也出现了同样的行为。
事实证明，SELinux 阻止了 have_ssl，因为证书不在 mysql/mariadb 的主目录中。
您只需将文件移动到 mysql 用户的主目录，您可以使用以下命令找到它：
grep mysql /etc/passwd | awk -F ':' '{ print $6}'
答案3
我遇到了另一个问题。我使用 OpenSSL 生成密钥，它创建了一个如下所示的 PKCS#8 文件：
-----BEGIN PRIVATE KEY-----
[base64 key material]
-----END PRIVATE KEY-----
看起来服务器正在等待一个 PKCS#1 文件，它看起来像这样：
-----BEGIN RSA PRIVATE KEY-----
[base64 key material]
----END RSA PRIVATE KEY-----
为了从一种形式转换为另一种形式，您可以使用openssl：
$ openssl rsa -in /path/to/pkcs8 > /path/to/pkcs1
完成此操作后，我就可以启动启用 SSL 的服务器。
OpenSSL 的新版本默认使用 PKCS#8，而旧版本默认使用 PKCS#1 文件（用于 RSA 密钥）。这可以解释为什么几年前编写（并且有效！）的指南现在会出现问题。
MariaDB 确实需要支持 PKCS#8 密钥文件。如果我的 MariaDB 是针对 OpenSSL 构建的，我相信这不会是个问题，但它和原始发帖者一样使用 YaSSL。