0

I am trying to enable TLS on mysql on windows trying out follwing steps:

c:/mysqlCert> openssl genrsa 2048 > ca-key.pem
c:/mysqlCert> openssl req -new -x509 -nodes -days 3600 -key ca-key.pem -out ca.pem
c:/mysqlCert> openssl req -newkey rsa:2048 -days 3600 -nodes -keyout server-key.pem -out server-req.pem
c:/mysqlCert> openssl rsa -in server-key.pem -out server-key.pem
c:/mysqlCert> openssl x509 -req -in server-req.pem -days 3600 -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem
c:/mysqlCert> openssl req -newkey rsa:2048 -days 3600 -nodes -keyout client-key.pem -out client-req.pem
c:/mysqlCert> openssl x509 -req -in client-req.pem -days 3600 -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out client-cert.pem
c:/mysqlCert> openssl verify -CAfile ca.pem server-cert.pem client-cert.pem

Now inside mysqlCert i get following files:

enter image description here

Inside the my.ini file under section [mysqld] added following:

    ssl-ca     = "C:\mysqlCert\ca.pem"
    ssl-cert   = "C:\mysqlCert\server-cert.pem"
    ssl-key    = "C:\mysqlCert\server-key.pem"

After above I enter command:

  SHOW GLOBAL VARIABLES LIKE 'have_%ssl';

And I don't see OpenSSL as enabled its still DISABLED and SSLL variables pointing to SSL files as follows:

enter image description here

So, please help me out what am i doing wrong.

jww
  • 97,681
  • 90
  • 411
  • 885
stack learner
  • 33
  • 2
  • 9
  • Stack Overflow is a site for programming and development questions. This question appears to be off-topic because it is not about programming or development. See [What topics can I ask about here](http://stackoverflow.com/help/on-topic) in the Help Center. Perhaps [Super User](http://superuser.com/) or [Database Administrators Stack Exchange](http://dba.stackexchange.com/) would be a better place to ask. Also see [Where do I post questions about Dev Ops?](http://meta.stackexchange.com/q/134306) – jww Mar 26 '17 at 20:01
  • ***`CN=www.example.com`*** is probably wrong. Hostnames always go in the *SAN*. If its present in the *CN*, then it must be present in the *SAN* too (you have to list it twice in this case). For more rules and reasons, see [How do you sign Certificate Signing Request with your Certification Authority](http://stackoverflow.com/a/21340898/608639) and [How to create a self-signed certificate with openssl?](http://stackoverflow.com/q/10175812/608639) – jww Mar 26 '17 at 20:03

1 Answers1

0

In the mysqld bloc change the "\" by "/" : like this, because you are in windows env

ssl-ca     = "C:/mysqlCerts/ca-cert.pem"
ssl-cert   = "C:/mysqlCerts/server-cert.pem"
ssl-key    = "C:/mysqlCerts/server-key-ppless.pem"
It0007
  • 503
  • 4
  • 11