1

When using let's encrypt the following directories are only accessible by root:

/etc/letsencrypt/live/
/etc/letsencrypt/archive/

When starting MariaDB it is run as "mysql" user and thus you get an error message when trying to enable SSL with the Let's Encrypt certificate.

[Warning] SSL error: SSL_CTX_set_default_verify_paths failed

This is expected behaviour so far. When I execute:

chmod 755 /etc/letsencrypt/live/
chmod 755 /etc/letsencrypt/archive/

This allows MariaDB to start with SSL enabled, which can be checked e.g. with the following command when connected to MariaDB:

show variables like '%ssl%'

Well, the question is how big of a security issue this is. Nginx can use Let's Encrypt certificates with the default privileges, even though it runs as user "nginx" on my system, but since it is using ports below < 1024 it seems to run with higher privileges than MariaDB does.

chmod 755 makes the letsencrypt private key files "world readable" on my system ... ugly. You can connect to my server through SSH public key authentication only and root is not allowed to login. The user who is allowed to login can't do anything except su root, so a brute force even on the system seems rather impossible. There are a few other sftp users on the system which are chrooted and can't access /etc/...

So I should be safe, but I wonder if there is any solution to this without making the letsencrypt directories world readable. (except using self signed certs for MariaDB of course)

  • There are (pre,deploy,post) hooks in certbot, where you can do the chown to mysql yourself. – Misko Mar 22 '18 at 14:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.