0

I'm having truble forcing MariaDB to use my SSL cert files on Debian 8.

Apache2 works fine with current file permissions in /etc/letsencrypt/* The only service that has any trouble with current certs is MariaDB.

I tried to use ACL on files in /etc/letsencrypt/live/domain/*.pem :

setfacl -m "u:mysql:r--" /etc/letsencrypt/live/domain/*.pem

It didn't work. After running bash as mysql user I discovered that /etc/letsencrypt/live is inaccessible by the mysql user. So I ran setfacl on live and domain dirs.

MariaDB is still not able to access these certs.

So... after copying .pem files to /etc/mysql and changing their ownership to mysql:mysql it kinda worked. Now I'm getting:

mysqld[4131]: 180211  0:27:54 [Warning] Failed to setup SSL
mysqld[4131]: 180211  0:27:54 [Warning] SSL error: Unable to get private key
mysqld[4131]: 180211  0:27:54 [Note] Server socket created on IP: 'x.x.x.x'.
mysqld[4131]: 180211  0:27:54 [Note] /usr/sbin/mysqld: ready for connections.

And the effect is following:

mysql --ssl -u root -p
Enter password: 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 137
Server version: 10.0.32-MariaDB-0+deb8u1 (Debian)

Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> SHOW STATUS LIKE 'Ssl_cipher';
+---------------+-------+
| Variable_name | Value |
+---------------+-------+
| Ssl_cipher    |       |
+---------------+-------+
1 row in set (0.01 sec)

MariaDB [(none)]> 

My current SSL section of /etc/mysql/my.cnf:

ssl-ca=/etc/mysql/chain.pem
ssl-cert=/etc/mysql/cert.pem
ssl-key=/etc/mysql/privkey.pem

What am I doing wrong? What I have to do to make MariaDB use that SSL? Why other services have totaly no problem at all with default permissions?

  • 1
    Did you try chmod the Private key as 0400 ? – Jacob Evans Feb 11 '18 at 0:04
  • @JacobEvans After running chmod 0400 ./privkey.pem I'm still getting the same errors. – Kristi Feb 11 '18 at 0:12
  • Any selinux errors? User should be root on these files as well – Jacob Evans Feb 11 '18 at 1:16
  • @JacobEvans There is no MAC on this host. – Kristi Feb 11 '18 at 1:17
  • Does your private key file start with exactly -----BEGIN RSA PRIVATE KEY-----, or something at all different? – Michael - sqlbot Feb 11 '18 at 1:39
4

After suggestion from this comment: MariaDB SSL configuration - using Let's Encrypt certificate

That my key is in the wrong format I tried to convert this key with openssl to different format.

openssl rsa -in ./privkey.pem -out ./privkeyrsa.pem

And after tweaking permissions (0400) and ownership of that file (mysql:mysql) SSL started to work as desired. (and of course config line to point to the right cert)

I still don't know if the permissions of the SSL cert should be leaved as they are or I should change them and potentially fix problem with /etc/letsencrypt/live being not accessible by mysql and accessible by everything else (even with proper ACL for mysql user).

But if it works and only mysql have access to these files everything should be just fine.

  • 1
    Glad you found the RSA key format issue. With MySQL (MariaDB), there's not really a strong use case for using a Let's Encrypt cert, because AFAIK you will need to restart the server to rotate the cert every few weeks. A MySQL Server shouldn't need a cert from a public CA. A self-signed cert should be sufficient. – Michael - sqlbot Feb 11 '18 at 13:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.