I'm having truble forcing MariaDB to use my SSL cert files on Debian 8.
Apache2 works fine with current file permissions in /etc/letsencrypt/* The only service that has any trouble with current certs is MariaDB.
I tried to use ACL on files in /etc/letsencrypt/live/domain/*.pem :
setfacl -m "u:mysql:r--" /etc/letsencrypt/live/domain/*.pem
It didn't work. After running bash as mysql user I discovered that /etc/letsencrypt/live is inaccessible by the mysql user. So I ran setfacl on live and domain dirs.
MariaDB is still not able to access these certs.
So... after copying .pem files to /etc/mysql and changing their ownership to mysql:mysql it kinda worked. Now I'm getting:
mysqld: 180211 0:27:54 [Warning] Failed to setup SSL mysqld: 180211 0:27:54 [Warning] SSL error: Unable to get private key mysqld: 180211 0:27:54 [Note] Server socket created on IP: 'x.x.x.x'. mysqld: 180211 0:27:54 [Note] /usr/sbin/mysqld: ready for connections.
And the effect is following:
mysql --ssl -u root -p Enter password: Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 137 Server version: 10.0.32-MariaDB-0+deb8u1 (Debian) Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MariaDB [(none)]> SHOW STATUS LIKE 'Ssl_cipher'; +---------------+-------+ | Variable_name | Value | +---------------+-------+ | Ssl_cipher | | +---------------+-------+ 1 row in set (0.01 sec) MariaDB [(none)]>
My current SSL section of /etc/mysql/my.cnf:
ssl-ca=/etc/mysql/chain.pem ssl-cert=/etc/mysql/cert.pem ssl-key=/etc/mysql/privkey.pem
What am I doing wrong? What I have to do to make MariaDB use that SSL? Why other services have totaly no problem at all with default permissions?