MariaDB SSL configuration - using Let's Encrypt certificate

Question

I'm having truble forcing MariaDB to use my SSL cert files on Debian 8.

Apache2 works fine with current file permissions in /etc/letsencrypt/* The only service that has any trouble with current certs is MariaDB.

I tried to use ACL on files in /etc/letsencrypt/live/domain/*.pem :

setfacl -m "u:mysql:r--" /etc/letsencrypt/live/domain/*.pem

It didn't work. After running bash as mysql user I discovered that /etc/letsencrypt/live is inaccessible by the mysql user. So I ran setfacl on live and domain dirs.

MariaDB is still not able to access these certs.

So... after copying .pem files to /etc/mysql and changing their ownership to mysql:mysql it kinda worked. Now I'm getting:

mysqld[4131]: 180211  0:27:54 [Warning] Failed to setup SSL
mysqld[4131]: 180211  0:27:54 [Warning] SSL error: Unable to get private key
mysqld[4131]: 180211  0:27:54 [Note] Server socket created on IP: 'x.x.x.x'.
mysqld[4131]: 180211  0:27:54 [Note] /usr/sbin/mysqld: ready for connections.

And the effect is following:

mysql --ssl -u root -p
Enter password: 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 137
Server version: 10.0.32-MariaDB-0+deb8u1 (Debian)

Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> SHOW STATUS LIKE 'Ssl_cipher';
+---------------+-------+
| Variable_name | Value |
+---------------+-------+
| Ssl_cipher    |       |
+---------------+-------+
1 row in set (0.01 sec)

MariaDB [(none)]> 

My current SSL section of /etc/mysql/my.cnf:

ssl-ca=/etc/mysql/chain.pem
ssl-cert=/etc/mysql/cert.pem
ssl-key=/etc/mysql/privkey.pem

What am I doing wrong? What I have to do to make MariaDB use that SSL? Why other services have totaly no problem at all with default permissions?

Answer 1

After suggestion from this comment: MariaDB SSL configuration - using Let's Encrypt certificate

That my key is in the wrong format I tried to convert this key with openssl to different format.

openssl rsa -in ./privkey.pem -out ./privkeyrsa.pem

And after tweaking permissions (0400) and ownership of that file (mysql:mysql) SSL started to work as desired. (and of course config line to point to the right cert)

I still don't know if the permissions of the SSL cert should be leaved as they are or I should change them and potentially fix problem with /etc/letsencrypt/live being not accessible by mysql and accessible by everything else (even with proper ACL for mysql user).

But if it works and only mysql have access to these files everything should be just fine.