Pre-General Availability Draft: 2018-02-16
MySQL can be compiled using OpenSSL or yaSSL, both of which enable encrypted connections based on the OpenSSL API:
MySQL Enterprise Edition binary distributions are compiled using OpenSSL. It is not possible to use yaSSL with MySQL Enterprise Edition.
MySQL Community Edition binary distributions are compiled using OpenSSL. (Prior to MySQL 8.0.4, MySQL Community Edition binary distributions are compiled using yaSSL.)
MySQL Community Edition source distributions can be compiled using either OpenSSL or yaSSL (see Section 6.4.5, “Building MySQL with Support for Encrypted Connections”).
OpenSSL and yaSSL offer the same basic functionality, but MySQL distributions compiled using OpenSSL have additional features:
OpenSSL supports a wider range of encryption ciphers from which to choose for the
--ssl-cipheroption. OpenSSL supports the
--ssl-crlpathoptions. See Section 6.4.2, “Command Options for Encrypted Connections”.
Accounts that authenticate using the
sha256_passwordplugin can use RSA key files for secure password exchange over unencrypted connections. See Section 184.108.40.206, “SHA-256 Pluggable Authentication”. (Accounts that authenticate using the
caching_sha2_passwordplugin can use RSA key pair-based password exchange regardless of whether MySQL was compiled using OpenSSL or yaSSL. See Section 220.127.116.11, “Caching SHA-2 Pluggable Authentication”.)
The server can automatically generate missing SSL and RSA certificate and key files at startup. See Section 18.104.22.168, “Creating SSL and RSA Certificates and Keys using MySQL”.
OpenSSL supports more encryption modes for the
AES_DECRYPT()functions. See Section 12.13, “Encryption and Compression Functions”
Certain OpenSSL-related system and status variables are present only if MySQL was compiled using OpenSSL:
To determine whether a server was compiled using OpenSSL, test the existence of any of those variables. For example, this statement returns a row if OpenSSL was used and an empty result if yaSSL was used:
SHOW STATUS LIKE 'Rsa_public_key';