MySQL 5.7 的SSL加密方法

MySQL 5.7.6或以上版本

(1)創建證書開啟SSL驗證

--安裝openssl

yum install -y openssl

openssl version

OpenSSL 1.0.1e-fips 11 Feb 2013

--安裝證書

/usr/local/mysql/bin/mysql_ssl_rsa_setup?? --datadir=/data/mysql/mysql3306/data

--修改權限

chown -R mysql:mysql /data/mysql/mysql3306/data

pwd

/data/mysql/mysql3306/data

[root@VM_45_133_centos Wed Jun 28 10:51:22 data]# ll

total 1024072

-rw-r----- 1 mysql mysql???????? 56 Jun 19 17:56 auto.cnf

-rw------- 1 root? root??????? 1679 Jun 28 10:48 ca-key.pem

-rw-r--r-- 1 root? root??????? 1074 Jun 28 10:48 ca.pem

-rw-r--r-- 1 root? root??????? 1078 Jun 28 10:48 client-cert.pem

-rw------- 1 root? root??????? 1679 Jun 28 10:48 client-key.pem

-rw-r----- 1 mysql mysql??????? 672 Jun 28 10:47 ib_buffer_pool

-rw-r----- 1 mysql mysql 1048576000 Jun 28 10:47 ibdata1

drwxr-x--- 2 mysql mysql?????? 4096 Jun 19 17:57 mysql

drwxr-x--- 2 mysql mysql?????? 4096 Jun 19 17:57 performance_schema

-rw------- 1 root? root??????? 1679 Jun 28 10:48 private_key.pem

-rw-r--r-- 1 root? root???????? 451 Jun 28 10:48 public_key.pem

drwxr-x--- 2 mysql mysql?????? 4096 Jun 23 10:48 school

-rw-r--r-- 1 root? root??????? 1078 Jun 28 10:48 server-cert.pem

-rw------- 1 root? root??????? 1675 Jun 28 10:48 server-key.pem

drwxr-x--- 2 mysql mysql????? 12288 Jun 19 17:57 sys

-rw-r----- 1 mysql mysql??????? 418 Jun 20 14:14 VM_45_133_centos.log

客戶端連接需要的證書，當然不用證書也是可以的

-rw-r--r-- 1 root? root??????? 1074 Jun 28 10:48 ca.pem

-rw-r--r-- 1 root? root??????? 1078 Jun 28 10:48 client-cert.pem

-rw------- 1 root? root??????? 1679 Jun 28 10:48 client-key.pem

-rw------- 1 root? root??????? 1679 Jun 28 10:48 private_key.pem

服務器上的證書

-rw-r--r-- 1 root? root??????? 1074 Jun 28 10:48 ca.pem

-rw------- 1 root? root??????? 1679 Jun 28 10:48 ca-key.pem

-rw-r--r-- 1 root? root???????? 451 Jun 28 10:48 public_key.pem

-rw-r--r-- 1 root? root??????? 1078 Jun 28 10:48 server-cert.pem

-rw------- 1 root? root??????? 1675 Jun 28 10:48 server-key.pem

--修改my.cnf

#########SSL#############

ssl-ca = /data/mysql/mysql3306/data/ca.pem

ssl-cert = /data/mysql/mysql3306/data/server-cert.pem

ssl-key = /data/mysql/mysql3306/data/server-key.pem

(2)重啟mysql

/etc/init.d/mysql stop

/etc/init.d/mysql start

--查看ssl參數狀態，查看have_ssl，為YES，這表示已經開始支持SSL了

show global variables like ‘%ssl%‘;

+---------------+--------------------------------------------+

| Variable_name | Value????????????????????????????????????? |

+---------------+--------------------------------------------+

| have_openssl? | YES??????????????????????????????????????? |

| have_ssl????? | YES??????????????????????????????????????? |

| ssl_ca??????? | /data/mysql/mysql3306/data/ca.pem????????? |

| ssl_capath??? |??????????????????????????????????????????? |

| ssl_cert????? | /data/mysql/mysql3306/data/server-cert.pem |

| ssl_cipher??? |??????????????????????????????????????????? |

| ssl_crl?????? |??????????????????????????????????????????? |

| ssl_crlpath?? |??????????????????????????????????????????? |

| ssl_key?????? | /data/mysql/mysql3306/data/server-key.pem? |

+---------------+--------------------------------------------+

show global status like ‘%ssl%‘;

+--------------------------------+--------------------------+

| Variable_name????????????????? | Value??????????????????? |

+--------------------------------+--------------------------+

| Com_show_processlist?????????? | 0??????????????????????? |

| Ssl_accept_renegotiates??????? | 0??????????????????????? |

| Ssl_accepts??????????????????? | 0??????????????????????? |

| Ssl_callback_cache_hits??????? | 0??????????????????????? |

| Ssl_cipher???????????????????? |????????????????????????? |

| Ssl_cipher_list??????????????? |????????????????????????? |

| Ssl_client_connects??????????? | 0??????????????????????? |

| Ssl_connect_renegotiates?????? | 0??????????????????????? |

| Ssl_ctx_verify_depth?????????? | 0??????????????????????? |

| Ssl_ctx_verify_mode??????????? | 0??????????????????????? |

| Ssl_default_timeout??????????? | 0??????????????????????? |

| Ssl_finished_accepts?????????? | 0??????????????????????? |

| Ssl_finished_connects????????? | 0??????????????????????? |

| Ssl_server_not_after?????????? | Jun 26 02:48:05 2027 GMT |

| Ssl_server_not_before????????? | Jun 28 02:48:05 2017 GMT |

| Ssl_session_cache_hits???????? | 0??????????????????????? |

| Ssl_session_cache_misses?????? | 0??????????????????????? |

| Ssl_session_cache_mode???????? | Unknown????????????????? |

| Ssl_session_cache_overflows??? | 0??????????????????????? |

| Ssl_session_cache_size???????? | 0??????????????????????? |

| Ssl_session_cache_timeouts???? | 0??????????????????????? |

| Ssl_sessions_reused??????????? | 0??????????????????????? |

| Ssl_used_session_cache_entries | 0??????????????????????? |

| Ssl_verify_depth?????????????? | 0??????????????????????? |

| Ssl_verify_mode??????????????? | 0??????????????????????? |

| Ssl_version??????????????????? |????????????????????????? |

+--------------------------------+--------------------------+

查看SSL的加密方式

show global variables like ‘tls_version‘;

+---------------+---------------+

| Variable_name | Value???????? |

+---------------+---------------+

| tls_version?? | TLSv1,TLSv1.1 |

+---------------+---------------+

(3)配置SSL用戶

取消ssl驗證

grant all privileges on *.* to abcssl@‘%‘ identified by ‘123456‘ require none;

alter user abcssl@‘%‘ require none;

--強制ssl驗證，即使設置了強制ssl，在登錄時候使用--ssl-mode=disable依然可以避開ssl驗證

grant all privileges on *.* to abcssl@‘%‘ identified by ‘123465‘ require ssl;

alter user abcssl@‘%‘ require ssl;

查看是否開啟強制用戶使用SSL

select user,host,ssl_type,ssl_cipher? from mysql.user;

+-----------+-----------+----------+------------+

| user????? | host????? | ssl_type | ssl_cipher |

+-----------+-----------+----------+------------+

| root????? | %???????? |????????? |??????????? |

| mysql.sys | localhost |????????? |??????????? |

| abcssl??? | %???????? | ANY????? |??????????? |

+-----------+-----------+----------+------------+

(4)連接數據庫的時候，帶上SSL

不指定客戶端證書方式

5.6

--ssl、--disable-ssl、--skip-ssl：在mysql5.7是將被廢棄的選項，將來版本不再支持，建議使用--ssl-mode選項，

/usr/local/mysql/bin/mysql -uroot -p -h127.0.0.1 --ssl? 默認為1

/usr/local/mysql/bin/mysql -uroot -p -h127.0.0.1 --ssl=0

/usr/local/mysql/bin/mysql -uroot -p -h127.0.0.1 --ssl=1? 默認為1

/usr/local/mysql/bin/mysql -uroot -p -h127.0.0.1 --disable-ssl

/usr/local/mysql/bin/mysql -uroot -p -h127.0.0.1 --skip-ssl

5.7

/usr/local/mysql/bin/mysql -uroot -p -h127.0.0.1 --ssl-mode=disable

/usr/local/mysql/bin/mysql -uroot -p -h127.0.0.1 --ssl-mode=required? 默認required

從另一臺機器連接過去也可以ssl加密，表明不需要安裝客戶端證書的

/usr/local/mysql/bin/mysql -uroot -p -h10.105.45.133 --ssl-mode=required

指定客戶端證書方式，5.6的方式，5.7也可以用

/usr/local/mysql/bin/mysql --ssl-ca=/data/mysql/mysql3306/data/ca.pem \

--ssl-cert=/data/mysql/mysql3306/data/client-cert.pem \

--ssl-key=/data/mysql/mysql3306/data/client-key.pem \

-uroot -p -h127.0.0.1

(5)連接驗證連接是否用了ssl

\s == status

--------------

/usr/local/mysql/bin/mysql? Ver 14.14 Distrib 5.7.18, for linux-glibc2.5 (x86_64) using? EditLine wrapper? 客戶端版本

Connection id:?? ??? ?69

Current database:

Current user:?? ??? ?root@127.0.0.1

SSL:?? ??? ??? ?Cipher in use is DHE-RSA-AES256-SHA

Current pager:?? ??? ?stdout

Using outfile:?? ??? ?‘‘

Using delimiter:?? ?;

Server version:?? ??? ?5.7.18-log MySQL Community Server (GPL)

Protocol version:?? ?10

Connection:?? ??? ?127.0.0.1 via TCP/IP

Server characterset:?? ?utf8mb4

Db???? characterset:?? ?utf8mb4

Client characterset:?? ?utf8

Conn.? characterset:?? ?utf8

TCP port:?? ??? ?3306

Uptime:?? ??? ??? ?28 min 14 sec

Threads: 2? Questions: 1755? Slow queries: 0? Opens: 114? Flush tables: 1? Open tables: 102? Queries per second avg: 1.036

--------------

JDBC客戶端的解決方法

連接字符串url中加入ssl=true或false：

url=jdbc:mysql://127.0.0.1:3306/framework?characterEncoding=utf8&useSSL=true

MySQL 5.7 的SSL加密方法

標簽：page???linu???rac???rom???user???設置???enter???char???nis

本條技術文章來源于互聯網，如果無意侵犯您的權益請點擊此處反饋版權投訴

本文系統來源：http://www.cnblogs.com/MYSQLZOUQI/p/7089135.html

總結

以上是生活随笔為你收集整理的mysql5.7 skip ssl_MySQL 5.7 的SSL加密方法的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。