2

I want to enable MySQL SSL. I have all the certificates and keys in /etc/ssl/private/myhost. They are also (successfully) used by Apache2.

I don't have SELinux or AppArmor running.

I configured my.cnf as follows

#ssl
ssl-ca=/etc/ssl/private/myhost/myhost.ca_bundle
ssl-cert=/etc/ssl/private/myhost/myhost.crt
ssl-key=/etc/ssl/private/myhost/myhost.key
ssl-cipher=DHE-RSA-AES256-SHA

I have set permissions so that users in the ssl-private group can read the files, and added all required daemons (ie. wwwrun, mysql, postfix) to that group. Permissions look like follows

myhost:/etc/ssl/private/myhost # l
total 32K
drwxr-xr-x 2 root ssl-private 4,0K lug 14 13:11 .
drwxrwx--- 4 root ssl-private 4,0K lug 14 12:32 ..
-rw-r--r-- 1 root ssl-private 1,5K mag 30  2000 AddTrustExternalCARoot.crt
-rw-r--r-- 1 root ssl-private 3,3K lug 14 13:11 myhost.ca_bundle
-rw-r--r-- 1 root ssl-private 2,1K lug 13 22:00 myhost.crt
-rw-r--r-- 1 root ssl-private 1,8K lug 14 12:41 myhost.csr
-rw-r----- 1 root ssl-private 3,2K lug 14 12:36 myhost.key
-rw-r--r-- 1 root ssl-private 1,8K feb 15 23:00 PositiveSSLCA2.crt

I also copied and pasted path of certificate file from my.cnf into command sudo -u mysql cat /etc/ssl/private/myhost/myhost.crt and it displayed my certificate. The same command worked for the key.

But finally when I start MySQL I get the following error:

SSL error: Unable to get certificate from '/etc/ssl/private/myhost/myhost.crt'
120814 14:20:37 [Warning] Failed to setup SSL
120814 14:20:37 [Warning] SSL error: Unable to get certificate

How can I fix that?

Improve this question
9
  • Is SELinux running?
    – quanta
    Aug 14, 2012 at 14:49
  • No selinux running
    – usr-local-ΕΨΗΕΛΩΝ
    Aug 14, 2012 at 14:54
  • SUSE is AppArmor. Did you see this page? forums.mysql.com/read.php?26,393495,393636#msg-393636
    – cjc
    Aug 14, 2012 at 14:54
  • @cjc I don't have AppArmon running. (un)Fortunately, depends on the POV, Windows Azure doesn't provide it by default
    – usr-local-ΕΨΗΕΛΩΝ
    Aug 14, 2012 at 14:56
  • 1
    Couple more things .. [1] Are you absolutely sure apparmor is disabled? Grep for mysqld is /var/log/messages and see share you find. [2] Could you copy those certificates to /tmp, update my.cnf and see if mysql starts with SSL?
    – Chida
    Aug 14, 2012 at 15:53

1 Answer 1

Reset to default
3

The problem lies in file ownership. I have seen the same with dkimproxy and have been able to resolve for that specific application.

Since the SSL certificates directory is owned by group ssl-private and since mysqld-safe runs as mysql group, Linux won't allow reading the private key. With dkim I successfully forced the program to run as a different group by editing the init script.

Solution 1 (fastest)

Make a copy of the certificates/keys directory and chown to mysql:mysql. Requires to synchronize the copies of the keys at every renewal. Perfectly scalable across applications and number of servers (suppose the same certificate is used by other apps too, for example Postfix) as soon as one updates the certificates with a script or a checklist (so you won't forget to copy certificates to a certain app)

Option 2

Ask on superuser.com :) how to share the same files between multiple groups

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .