I am trying to set up an encrypted connection from the MySQL database command line client to the MySQL database instance on AWS.
AWS provided a certificate bundle which seems to have all their certificates for all their servers.
The MySQL docs Creating SSL Certificates and Keys Using OpenSSL says I need to do this:
(1) Create CA certificate
openssl genrsa 2048 > ca-key.pem openssl req -new -x509 -nodes -days 3600 -key ca-key.pem -out ca.pem
(2) Create server certificate, remove passphrase, and sign it.
server-cert.pem = public key
server-key.pem = private key
openssl req -newkey rsa:2048 -days 3600 \ -nodes -keyout server-key.pem -out server-req.pem openssl rsa -in server-key.pem -out server-key.pem openssl x509 -req -in server-req.pem -days 3600 \ -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem
(3) Create client certificate, remove passphrase, and sign it.
client-cert.pem = public key
client-key.pem = private key
openssl req -newkey rsa:2048 -days 3600 \ -nodes -keyout client-key.pem -out client-req.pem openssl rsa -in client-key.pem -out client-key.pem openssl x509 -req -in client-req.pem -days 3600 -CA ca.pem \ -CAkey ca-key.pem -set_serial 01 -out client-cert.pem openssl verify -CAfile ca.pem server-cert.pem client-cert.pem
I already have
ca.pem (rds-combined-ca-bundle.pem) from AWS.
So I have to skip steps (1) & (2).
Do I have the server public key
ca-key.pem in the AWS bundle?
If so, how do I use it to complete step (3)?
The AWS docs - 'SSL Support for MySQL DB Instances' are particularly sparse and just say:
mysql -h myinstance.c9akciq32.rds-us-east-1.amazonaws.com -u my-user -p --ssl-ca=rds-combined-ca-bundle.pem --ssl-verify-server-cert
which should prompt me for the password, but just hangs.
I already have the connection set up and working for MySQL Workbench and for the Java JDBC connection pool, and the telnet sanity test shows that the MySQL server is reachable.