2

I'm trying set ssl connection with MySQL Server. I've read this and many more articles https://dev.mysql.com/doc/refman/5.7/en/using-secure-connections.html

There is one thing i still don't know, does client certificate and key have to be generated with the same ca-key, as server sertificates? I don't have access to the server configuration, so I can't do anything server-side.

3

Do client certificate and key have to be generated with the same ca-key, as server certificates?

No, the main requirement for the client certificate is that the server trusts the CA which has signed that client certificate. In theory you can even trust multiple CA's and use client certificates from completely different sources.

Which CA has signed the server certificate of the MySQL server is irrelevant to the client authentication. (It should of course still be a CA that is trusted on the client...) I.e. you can use a letsencrypt server certificate and use your own internal CA so sign client certificates.

In addition: typically the CA only signs the public key/certificate and it does not generate private keys. (You generate a private key and certificate signing request (CSR) on the system which will using it. The private key then never leaves that system and the CSR is sent to the CA which returns a signed certificate.)

3
  • so, most likely I'd have to buy a certificate, so it would be trusted by server? – Tomasz Kal Jun 23 '16 at 8:45
  • You don't need a client certificate at all to be able to use SSL secured connections. Just enabling SSL on the server is sufficient. You can then securely transmit your credentials and data. - - Just buying a certificate and then trying to use it as a client certificate is also insufficient to get client authentication to work. The server still needs to be explicitly configured to support cleint certificates. – HBruijn Jun 23 '16 at 9:00
  • I haven't even thought of that before, but apparently it works on my local test server! Thanks for help, that solved my problem – Tomasz Kal Jun 23 '16 at 9:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.