mysql通过ssl的方式生成秘钥具体生成步骤_Mysql

-- mysql ssl 生成秘钥
1 check ssl是否已经开启
mysql> show variables like '%ssl%';
+---------------+----------+
| Variable_name | Value |
+---------------+----------+
| have_openssl | DISABLED |
| have_ssl | DISABLED |
| ssl_ca | |
| ssl_capath | |
| ssl_cert | |
| ssl_cipher | |
| ssl_crl | |
| ssl_crlpath | |
| ssl_key | |
+---------------+----------+
9 rows in set (0.00 sec)

2 没有开启,所以打开
在my.cnf末尾端设置ssl 参数， 然后重新启动mysql服务即可
mysql> show variables like '%ssl%';
+---------------+-------+
| Variable_name | Value |
+---------------+-------+
| have_openssl | YES |
| have_ssl | YES |
| ssl_ca | |
| ssl_capath | |
| ssl_cert | |
| ssl_cipher | |
| ssl_crl | |
| ssl_crlpath | |
| ssl_key | |
+---------------+-------+
9 rows in set (0.00 sec)

3 通过openssl生成证书的配置, 在mysql db server上生成秘钥
mkdir -p /etc/mysql/newcerts/
cd /etc/mysql/newcerts/
3.1 openssl genrsa 2048 > ca-key.pem
3.2 openssl req -new -x509 -nodes -days 1000 -key ca-key.pem > ca-cert.pem
[root@mysql newcerts]# openssl req -new -x509 -nodes -days 1000 -key ca-key.pem > ca-cert.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:ch
State or Province Name (full name) []:shh
Locality Name (eg, city) [Default City]:shh
Organization Name (eg, company) [Default Company Ltd]:xx
Organizational Unit Name (eg, section) []:db
Common Name (eg, your name or your server''s hostname) []:mysql.yest.nos
Email Address []:xx@xx.com
3.3 openssl req -newkey rsa:2048 -days 1000 -nodes -keyout server-key.pem > server-req.pem
[root@mysql newcerts]# openssl req -newkey rsa:2048 -days 1000 -nodes -keyout server-key.pem > server-req.pem
Generating a 2048 bit RSA private key
.......................................................................................................+++
..........................................................+++
writing new private key to 'server-key.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:ch
State or Province Name (full name) []:shh
Locality Name (eg, city) [Default City]:ssh
Organization Name (eg, company) [Default Company Ltd]:xx
Organizational Unit Name (eg, section) []:db
Common Name (eg, your name or your server''s hostname) []:mysql.yest.nos
Email Address []:xx@xx.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:820923
An optional company name []:xx

4 在mysql db server客户端生成ssl文件
4.1 openssl x509 -req -in server-req.pem -days 1000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-cert.pem
[root@mysql newcerts]# openssl x509 -req -in server-req.pem -days 1000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-cert.pem
Signature ok
subject=/C=ch/ST=shh/L=ssh/O=ea/OU=db/CN=mysql.yest.nos/emailAddress=cm@xx.com
Getting CA Private Key
4.2 openssl req -newkey rsa:2048 -days 1000 -nodes -keyout client-key.pem > client-req.pem
[root@mysql newcerts]# openssl req -newkey rsa:2048 -days 1000 -nodes -keyout client-key.pem > client-req.pem
Generating a 2048 bit RSA private key
.......+++
........................................................+++
writing new private key to 'client-key.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:ch
State or Province Name (full name) []:shh
Locality Name (eg, city) [Default City]:shh
Organization Name (eg, company) [Default Company Ltd]:xx
Organizational Unit Name (eg, section) []:db
Common Name (eg, your name or your server''s hostname) []:mysql.yest.nos
Email Address []:cx@xx.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:820923
An optional company name []:xx
4.3
openssl x509 -req -in client-req.pem -days 1000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > client-cert.pem
[root@mysql newcerts]# openssl x509 -req -in client-req.pem -days 1000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > client-cert.pem
Signature ok
subject=/C=ch/ST=shh/L=shh/O=ea/OU=db/CN=mysql.yest.nos/emailAddress=cm@xx.com
Getting CA Private Key

5
[]copy clent.* 3个文件到客户端机器上面/opt/mysql/ssl/去。

6 登陆验证
mysql -uxxx -pxxxx --ssl-ca=/opt/mysql/ssl/ca-cert.pem --ssl-cert=/opt/mysql/ssl/server-cert.pem --ssl-key=/opt/mysql/ssl/server-key.pem
conferce：http://www.docin.com/p-151590189.html

时间： 2025-01-23 12:06:54

mysql通过ssl的方式生成秘钥具体生成步骤_Mysql的相关文章

为什么XShell登录的用户不用事先生成秘钥

问题描述 为什么XShell登录的用户不用事先生成秘钥 看ssh的原理上说的,在一个用户可以进行ssh登录之前,他需要先在客户端生成自己的密钥对,然后通过安全的方式将秘钥对里的公钥放到服务器上~/.ssh/keyras_pub下面,但是实际用XShell登录的时候确不需要生成,直接登录就可以了,这是什么原理呢?求指点. 解决方案 如果是用密码方式就不需要私钥

rsa-RSA算法如何生成一个长度较短的秘钥

问题描述 RSA算法如何生成一个长度较短的秘钥 正在使用RSA算法生成秘钥,但是生成的秘钥是在太长,有知道如何生成短一些的秘钥的吗 解决方案 你生成的时候可以指定长度的 比如openssl http://blog.csdn.net/tsuliuchao/article/details/8447690 genrsa -out rsa_private_key.pem 1024 解决方案二: http://www.educity.cn/wenda/457162.html 参考.

秘钥认证用户自动控制

先上图 再上代码 #!/bin/bash #author: QingFeng #qq: 530035210 #blog: http://my.oschina.net/pwd/blog #自动添加秘钥认证用户 #缺省的配置如下 logdir=/data/log/shell #日志路径 log=$logdir/shell.log #日志文件 is_font=1 #终端是否打印日志: 1打印 0不打印 is_log=0 #是否记录日志: 1记录 0不记录 random_time=$(date +%Y%

ssl协议-sslv1协议中“秘钥导出”的计算过程

问题描述 sslv1协议中"秘钥导出"的计算过程 不同版本计算方式不同.我只知道大致用md5和sha加密生成主秘钥,再生成6个会话秘钥.可具体多少字节过程不知道,网上也没说清楚 解决方案 你想看密钥导出的过程?你可以去OPENSSL的官网下源代码,然后你在看看这个秘钥导出的过程到底是怎么导的.密钥导出涉及到握手,握手的时候会交换是哪个随机数组,这个三个随机数组是密钥导出的根本.在握手的时候,会协商加密套件,加密套件的协商之间决定了密钥导出的算法,有了加密套件,有了随机数组(即种子),最

使用CloudFlare 的 PKI 工具集 cfssl 来生成 Certificate Authority (CA) 证书和秘钥文件

要安装kubernetes最新版集群,https://github.com/opsnull/follow-me-install-kubernetes-cluster 这个文档必须要研习一下了. 以下实验就摘自这个文档的开始. ================================================ 使用CloudFlare 的 PKI 工具集 cfssl 来生成 Certificate Authority (CA) 证书和秘钥文件, CA 是自签名的证书,用来签名后续创建

php-java 利用md5生成带秘钥的哈希值 有相应的函数吗

问题描述 java 利用md5生成带秘钥的哈希值 有相应的函数吗 哪位大牛知道php的 hash_hmac ( string $algo , string $data , string $key [, bool $raw_output = false ] ),在java中有对应的函数吗 解决方案 JAVA生成HMAC-SHA1数据签名 解决方案二: 上面的SHA1的,还有HMAC-MD5 算法的java实例和BASE64,MD5,SHA,HMAC加密解决算法 解决方案三: Java实现MD5加密

如何通过抓包查看客户端https连接中ssl/tls加密所采用的秘钥位数

 在https传输的过程中,我们底层的加密传输协议是ssl/tls.这里所使用的加密算法的秘钥位数(也就是服务器所使用的https证书的位数)可能是1024/2048或者更高,目前1024位的证书已经被证实是不安全的,需要逐步替换掉. 那么如何通过抓包来查看当前连接所采用的实际加密位数呢(注意,这里是抓包查看,如果是网页我们用浏览器直接访问,点击那个小锁然后进行一系列的操作就可以查看到连接信息了,如果有兴趣查看以下链接内容:http://www.wosign.com/FAQ/how_to_che

多个git账户生成多份rsa秘钥实现多个账户同时使用配置

使用过git的童鞋应该对id_rsa秘钥不陌生,总得用github吧,生成id_rsa很容易: ssh-keygen -t rsa -C "$your_email" 默认情况下,这个秘钥是在你账户的.ssh目录生成id_rsa文件,对应一个id_rsa.pub公钥文件, $ ssh-keygen -t rsa -C "test@test.com" Generating public/private rsa key pair. Enter file in which

MySQL怎么使用SSL连接配置 MySQL使用SSL连接配置的方法

查看是否支持 SSL 首先在 MySQL 上执行如下命令, 查询是否 MySQL 支持 SSL: mysql> SHOW VARIABLES LIKE 'have_ssl'; +---------------+-------+ | Variable_name | Value | +---------------+-------+ | have_ssl | YES | +---------------+-------+ 1 row in set (0.02 sec) 当 have_ssl 为 YE