Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to enable MySQL SSL. I have all the certificates and keys in /etc/ssl/private/myhost. They are also (successfully) used by Apache2.

I don't have SELinux or AppArmor running.

I configured my.cnf as follows


I have set permissions so that users in the ssl-private group can read the files, and added all required daemons (ie. wwwrun, mysql, postfix) to that group. Permissions look like follows

myhost:/etc/ssl/private/myhost # l
total 32K
drwxr-xr-x 2 root ssl-private 4,0K lug 14 13:11 .
drwxrwx--- 4 root ssl-private 4,0K lug 14 12:32 ..
-rw-r--r-- 1 root ssl-private 1,5K mag 30  2000 AddTrustExternalCARoot.crt
-rw-r--r-- 1 root ssl-private 3,3K lug 14 13:11 myhost.ca_bundle
-rw-r--r-- 1 root ssl-private 2,1K lug 13 22:00 myhost.crt
-rw-r--r-- 1 root ssl-private 1,8K lug 14 12:41 myhost.csr
-rw-r----- 1 root ssl-private 3,2K lug 14 12:36 myhost.key
-rw-r--r-- 1 root ssl-private 1,8K feb 15 23:00 PositiveSSLCA2.crt

I also copied and pasted path of certificate file from my.cnf into command sudo -u mysql cat /etc/ssl/private/myhost/myhost.crt and it displayed my certificate. The same command worked for the key.

But finally when I start MySQL I get the following error:

SSL error: Unable to get certificate from '/etc/ssl/private/myhost/myhost.crt'
120814 14:20:37 [Warning] Failed to setup SSL
120814 14:20:37 [Warning] SSL error: Unable to get certificate

How can I fix that?

share|improve this question
Is SELinux running? – quanta Aug 14 '12 at 14:49
No selinux running – usr-local-ΕΨΗΕΛΩΝ Aug 14 '12 at 14:54
SUSE is AppArmor. Did you see this page?,393495,393636#msg-393636 – cjc Aug 14 '12 at 14:54
@cjc I don't have AppArmon running. (un)Fortunately, depends on the POV, Windows Azure doesn't provide it by default – usr-local-ΕΨΗΕΛΩΝ Aug 14 '12 at 14:56
Couple more things .. [1] Are you absolutely sure apparmor is disabled? Grep for mysqld is /var/log/messages and see share you find. [2] Could you copy those certificates to /tmp, update my.cnf and see if mysql starts with SSL? – Chida Aug 14 '12 at 15:53
up vote 2 down vote accepted

The problem lies in file ownership. I have seen the same with dkimproxy and have been able to resolve for that specific application.

Since the SSL certificates directory is owned by group ssl-private and since mysqld-safe runs as mysql group, Linux won't allow reading the private key. With dkim I successfully forced the program to run as a different group by editing the init script.

Solution 1 (fastest)

Make a copy of the certificates/keys directory and chown to mysql:mysql. Requires to synchronize the copies of the keys at every renewal. Perfectly scalable across applications and number of servers (suppose the same certificate is used by other apps too, for example Postfix) as soon as one updates the certificates with a script or a checklist (so you won't forget to copy certificates to a certain app)

Option 2

Ask on :) how to share the same files between multiple groups

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.