Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to enable MySQL SSL. I have all the certificates and keys in /etc/ssl/private/myhost. They are also (successfully) used by Apache2.

I don't have SELinux or AppArmor running.

I configured my.cnf as follows

#ssl
ssl-ca=/etc/ssl/private/myhost/myhost.ca_bundle
ssl-cert=/etc/ssl/private/myhost/myhost.crt
ssl-key=/etc/ssl/private/myhost/myhost.key
ssl-cipher=DHE-RSA-AES256-SHA

I have set permissions so that users in the ssl-private group can read the files, and added all required daemons (ie. wwwrun, mysql, postfix) to that group. Permissions look like follows

myhost:/etc/ssl/private/myhost # l
total 32K
drwxr-xr-x 2 root ssl-private 4,0K lug 14 13:11 .
drwxrwx--- 4 root ssl-private 4,0K lug 14 12:32 ..
-rw-r--r-- 1 root ssl-private 1,5K mag 30  2000 AddTrustExternalCARoot.crt
-rw-r--r-- 1 root ssl-private 3,3K lug 14 13:11 myhost.ca_bundle
-rw-r--r-- 1 root ssl-private 2,1K lug 13 22:00 myhost.crt
-rw-r--r-- 1 root ssl-private 1,8K lug 14 12:41 myhost.csr
-rw-r----- 1 root ssl-private 3,2K lug 14 12:36 myhost.key
-rw-r--r-- 1 root ssl-private 1,8K feb 15 23:00 PositiveSSLCA2.crt

I also copied and pasted path of certificate file from my.cnf into command sudo -u mysql cat /etc/ssl/private/myhost/myhost.crt and it displayed my certificate. The same command worked for the key.

But finally when I start MySQL I get the following error:

SSL error: Unable to get certificate from '/etc/ssl/private/myhost/myhost.crt'
120814 14:20:37 [Warning] Failed to setup SSL
120814 14:20:37 [Warning] SSL error: Unable to get certificate

How can I fix that?

share|improve this question
    
Is SELinux running? –  quanta Aug 14 '12 at 14:49
    
No selinux running –  djechelon Aug 14 '12 at 14:54
    
SUSE is AppArmor. Did you see this page? forums.mysql.com/read.php?26,393495,393636#msg-393636 –  cjc Aug 14 '12 at 14:54
    
@cjc I don't have AppArmon running. (un)Fortunately, depends on the POV, Windows Azure doesn't provide it by default –  djechelon Aug 14 '12 at 14:56
1  
Couple more things .. [1] Are you absolutely sure apparmor is disabled? Grep for mysqld is /var/log/messages and see share you find. [2] Could you copy those certificates to /tmp, update my.cnf and see if mysql starts with SSL? –  Chida Aug 14 '12 at 15:53
show 4 more comments

1 Answer

The problem lies in file ownership. I have seen the same with dkimproxy and have been able to resolve for that specific application.

Since the SSL certificates directory is owned by group ssl-private and since mysqld-safe runs as mysql group, Linux won't allow reading the private key. With dkim I successfully forced the program to run as a different group by editing the init script.

Solution 1 (fastest)

Make a copy of the certificates/keys directory and chown to mysql:mysql. Requires to synchronize the copies of the keys at every renewal. Perfectly scalable across applications and number of servers (suppose the same certificate is used by other apps too, for example Postfix) as soon as one updates the certificates with a script or a checklist (so you won't forget to copy certificates to a certain app)

Option 2

Ask on superuser.com :) how to share the same files between multiple groups

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.