I'm having truble forcing MariaDB to use my SSL cert files on Debian 8.
Apache2 works fine with current file permissions in /etc/letsencrypt/* The only service that has any trouble with current certs is MariaDB.
I tried to use ACL on files in /etc/letsencrypt/live/domain/*.pem :
setfacl -m "u:mysql:r--" /etc/letsencrypt/live/domain/*.pem
It didn't work. After running bash as mysql user I discovered that /etc/letsencrypt/live is inaccessible by the mysql user. So I ran setfacl on live and domain dirs.
MariaDB is still not able to access these certs.
So... after copying .pem files to /etc/mysql and changing their ownership to mysql:mysql it kinda worked. Now I'm getting:
mysqld[4131]: 180211 0:27:54 [Warning] Failed to setup SSL
mysqld[4131]: 180211 0:27:54 [Warning] SSL error: Unable to get private key
mysqld[4131]: 180211 0:27:54 [Note] Server socket created on IP: 'x.x.x.x'.
mysqld[4131]: 180211 0:27:54 [Note] /usr/sbin/mysqld: ready for connections.
And the effect is following:
mysql --ssl -u root -p
Enter password:
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 137
Server version: 10.0.32-MariaDB-0+deb8u1 (Debian)
Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> SHOW STATUS LIKE 'Ssl_cipher';
+---------------+-------+
| Variable_name | Value |
+---------------+-------+
| Ssl_cipher | |
+---------------+-------+
1 row in set (0.01 sec)
MariaDB [(none)]>
My current SSL section of /etc/mysql/my.cnf:
ssl-ca=/etc/mysql/chain.pem
ssl-cert=/etc/mysql/cert.pem
ssl-key=/etc/mysql/privkey.pem
What am I doing wrong? What I have to do to make MariaDB use that SSL? Why other services have totaly no problem at all with default permissions?
0400
?chmod 0400 ./privkey.pem
I'm still getting the same errors.-----BEGIN RSA PRIVATE KEY-----
, or something at all different?