To enable secure connections, your MySQL distribution must be built with SSL support, as described in Section 6.4.2, “Building MySQL with Support for Secure Connections”. In addition, the proper options must be used to specify the appropriate certificate and key files. For a complete list of options related to establishment of secure connections, see Section 6.4.5, “Command Options for Secure Connections”.
If you need to create the required certificate and key files, see Section 6.4.6, “Creating SSL and RSA Certificates and Keys”.
To start the MySQL server so that it permits clients to connect securely, use options that identify the certificate and key files the server uses when establishing a secure connection:
For example, start the server with these lines in the
my.cnf file, changing the file names as
[mysqld] ssl-ca=ca.pem ssl-cert=server-cert.pem ssl-key=server-key.pem
Each option names a file in PEM format. If you have a MySQL source
distribution, you can test your setup using the demonstration
certificate and key files in its
To connect securely to a MySQL server that supports secure
connections, the options that a client must specify depend on the
encryption requirements of the MySQL account used by the client.
(See the discussion of the
REQUIRE clause in
Section 220.127.116.11, “GRANT Syntax”.)
Suppose that you want to connect using an account that has no
special encryption requirements or was created using a
GRANT statement that includes the
REQUIRE SSL option. As a recommended set of
secure-connection options, start the server with at least
--ssl-key, and invoke the client
--ssl-ca. A client can
connect securely like this:
To require that a client certificate also be specified, create the
account using the
REQUIRE X509 option. Then the
client must also specify the proper client key and certificate
files or the server will reject the connection:
mysql --ssl-ca=ca.pem \
A client can determine whether the current connection with the
server uses encryption by checking the value of the
Ssl_cipher status variable. If
the value is empty, the connection is not encrypted. Otherwise,
the connection is encrypted and the value indicates the encryption
cipher. For example:
SHOW STATUS LIKE 'Ssl_cipher';+---------------+--------------------+ | Variable_name | Value | +---------------+--------------------+ | Ssl_cipher | DHE-RSA-AES256-SHA | +---------------+--------------------+
For the mysql client, an alternative is to use
\s command and
\s... SSL: Cipher in use is DHE-RSA-AES256-SHA ...
\s... SSL: Not in use ...
The C API enables application programs to use secure connections:
To determine whether encryption is in use after the connection is established, use
mysql_get_ssl_cipher(). A non-
NULLreturn value indicates an encrypted connection and names the cipher used for encryption. A
NULLreturn value indicates that encryption is not being used. See Section 18.104.22.168, “mysql_get_ssl_cipher()”.
Replication uses the C API, so secure connections can be used between master and slave servers. See Section 17.3.8, “Setting Up Replication to Use Secure Connections”.