Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an Ubuntu Dapper 6.06 server. It's running MySQL 5.0. I want to enable clients to connect over SSL. However when I uncomment the ssl-* lines in /etc/mysql/my.cnf, I get the following errors:

[ERROR] /usr/sbin/mysqld: unknown variable 'ssl-ca=/etc/mysql/ca-cert.pem'

Which implies that SSL isn't available for this version. I'm not so keen on recompiling mysql, since I prefer doing things with the package manager.

How can I install SSL MySQL on ubuntu?

share|improve this question

4 Answers 4

up vote 1 down vote accepted

Sounds like compiling with SSL would be worth the effort.

Alternatively, you could open a SSL "proxy tunnel" from the client machine to the linux server box (using Putty ) and then your client will effectively encrypted. Just an idea if you cant get SSL into your MySQL.

share|improve this answer
    
Yeah, that's actually how I enable encrypted remote connections: tunnel SSH to the database host. Then the grants only need to allow localhost, too, which is nice. The MySQL site seems to mildly discourage SSL because of the high CPU overhead. I gather it's possible that SSH handles encryption with lower overhead than mysqld does. –  user5336 Aug 24 '09 at 16:09
    
Yes I was thinking of that. But that introduces another layer of complexity and another thing that could go wrong, hence why I'm reluctant. –  Rory Aug 24 '09 at 16:19

I'm fairly certain that to get SSL support, you need to compile it yourself, which is a downer.

share|improve this answer

Do you have a certificate available at /etc/mysql/ca-cert.pem ? If not I would suggest getting at least a self signed cert. Such as This

share|improve this answer
    
Yes I followed all the steps on the MySQL documentation for creating certs & CAs –  Rory Aug 24 '09 at 16:18

Sorry, my last answer wasnt careful enough.

I think that the MySQL is looking for a "certificate authority" file. A CA is a file that has a cert in it that all clients need to match when they present their certs. Its kinda like the java cacerts KEYSTORE except that you export the cert outside of the keystore into a PEM format.

Then, if your MySQL clients are presenting a key that matches, the SSL connection will bind.

So, you need to pay attention to the key.pem that the client is using to connect with , since it will need to match the ca-cert.pem key on the server. If you can read the PEM files with a keytool then you can compare the cert serial numbers between the client and server to make sure they are correct.

Just follow the instructions here: http://dev.mysql.com/doc/refman/5.0/en/secure-create-certs.html

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.