Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a MySQL (actually mariaDB) install that I just started replicating to another server. I want to ensure that I've setup SSL correctly. The SSL portion of SHOW SLAVE STATUS looks like:

Master_SSL_Allowed: Yes
Master_SSL_CA_File: /etc/mysql/newcerts/ca-cert.pem
Master_SSL_CA_Path: /etc/mysql/newcerts/
Master_SSL_Cert: /etc/mysql/newcerts/client-cert.pem
Master_SSL_Cipher:
Master_SSL_Key: /etc/mysql/newcerts/client-key.pem
Seconds_Behind_Master: 0
Master_SSL_Verify_Server_Cert: No

Is this typical or show that replication is using SSL? Is there something else I can check to ensure it's using SSL? The slave is successfully replicating.

share|improve this question
add comment

3 Answers 3

up vote 4 down vote accepted

Inspect the relevant traffic with tcpdump/wireshark.

share|improve this answer
    
You know, there might be a better way, but there's something to be said about literally seeing it happening. It's reassuring. +1 –  gparent Dec 21 '12 at 15:53
    
Agreed. TIL tcpdump. –  tubaguy50035 Dec 21 '12 at 19:22
add comment

Make sure the slave replication account has SSL requirements on it. Just because the master support SSL, doesn't mean the account is required to use it.

share|improve this answer
    
Agreed and configured that way. –  tubaguy50035 Dec 21 '12 at 20:45
    
Then, if the replication is actually working that should be enough, because the master wouldn't let the slave connect with SSL disabled. –  Tonin May 20 '13 at 12:20
add comment

When the Master_SSL_Cipher line doesn't output an actual OpenSSL cipher, this is a bad sign.

The list of valid OpenSSL cipher on your platform is given by the command openssl ciphers -v If the connection to the slave is encrypted, I'd expect to find one of the listed ciphers to be present on the Master_SSL_Cipher: line.

share|improve this answer
1  
Well, I have it working now and there is nothing in the Master_SSL_Cipher line. I verified that it IS working with SSL using tcpdump. –  tubaguy50035 Dec 21 '12 at 19:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.