Enable MySQL's SSL/TLS encrypted connection can effectively prevent data leakage. The specific steps are as follows: 1. Confirm that the MySQL version supports SSL, and check whether the return value is YES through SHOW VARIABLES LIKE 'have_ssl'; 2. Prepare a PEM format certificate file (ca.pem, server-cert.pem, server-key.pem), which can be generated or obtained from CA through OpenSSL; 3. Modify the MySQL configuration file, add ssl-ca, ssl-cert and ssl-key paths in the [mysqld] section and restart the service; 4. Force the client to use SSL, set REQUIRE through CREATE USER or GRANT USAGE SSL; 5. Manually specify SSL parameters such as --ssl-ca and --ssl-mode when the client connects. During the configuration process, you need to pay attention to the correct certificate path and strict permission settings (600 recommended) to avoid connection failure.
Enable MySQL-encrypted SSL/TLS connections are not complicated, but many people tend to ignore configuration details. After correct settings, data leakage during database communication can be effectively prevented.
Confirm that MySQL supports SSL
First, make sure that your MySQL version supports SSL functionality. Most modern versions (such as 5.7 and above) are supported by default, but you can check it with the following command:
SHOW VARIABLES LIKE 'have_ssl';
If YES is returned, it means that MySQL already has SSL support. If DISABLED or NO is displayed, the certificate path may be required to be installed or configured.
Prepare SSL certificate files
MySQL uses a PEM format certificate file to establish an encrypted connection. You need to prepare the following documents:
- CA Certificate (ca.pem)
- Server Certificate (server-cert.pem)
- Server private key (server-key.pem)
These files can be generated by OpenSSL or can be obtained from a trusted certificate authority. If you are just testing, you can use the following command to quickly generate a set of self-signed certificates:
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout server-key.pem -out server-cert.pem
Then put them in a secure directory, such as /etc/mysql/ssl/ .
Modify MySQL configuration file
Open MySQL configuration file (usually /etc/my.cnf or /etc/mysql/my.cnf ) and add the following content in the [mysqld] section:
[mysqld] ssl-ca=/etc/mysql/ssl/ca.pem ssl-cert=/etc/mysql/ssl/server-cert.pem ssl-key=/etc/mysql/ssl/server-key.pem
Save and restart MySQL service:
sudo systemctl restart mysql
After restarting, execute SHOW VARIABLES LIKE 'have_ssl'; again, and this time you should return YES .
Force the client to use SSL connection
If you want to force a user to connect only through SSL, you can create a user or modify an existing user like this:
CREATE USER 'secure_user'@'%' IDENTIFIED BY 'password' REQUIRE SSL;
Or set it for existing users:
GRANT USAGE ON *.* TO 'existing_user'@'%' REQUIRE SSL; FLUSH PRIVILEGES;
You can also manually specify SSL parameters when the client connects, for example using the command line tool:
mysql -u secure_user -p --host=your.mysql.server --ssl-ca=/path/to/ca.pem --ssl-mode=VERIFY_IDENTITY
Basically that's it. Although SSL/TLS settings seem to have many steps, they are not difficult to do as long as they take them step by step. The key is that the certificate path must be correct and the permissions and configurations must not be written incorrectly. Sometimes you can't connect, it may be just because the file permissions are too loose, remember to set them to 600 or more.
The above is the detailed content of How to enable SSL/TLS encryption for MySQL connections?. For more information, please follow other related articles on the PHP Chinese website!
Hot AI Tools
Undress AI Tool
Undress images for free
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Clothoff.io
AI clothes remover
Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
What is a typical process for MySQL master failover?
Jun 19, 2025 am 01:06 AM
MySQL main library failover mainly includes four steps. 1. Fault detection: Regularly check the main library process, connection status and simple query to determine whether it is downtime, set up a retry mechanism to avoid misjudgment, and can use tools such as MHA, Orchestrator or Keepalived to assist in detection; 2. Select the new main library: select the most suitable slave library to replace it according to the data synchronization progress (Seconds_Behind_Master), binlog data integrity, network delay and load conditions, and perform data compensation or manual intervention if necessary; 3. Switch topology: Point other slave libraries to the new master library, execute RESETMASTER or enable GTID, update the VIP, DNS or proxy configuration to
How to connect to a MySQL database using the command line?
Jun 19, 2025 am 01:05 AM
The steps to connect to the MySQL database are as follows: 1. Use the basic command format mysql-u username-p-h host address to connect, enter the username and password to log in; 2. If you need to directly enter the specified database, you can add the database name after the command, such as mysql-uroot-pmyproject; 3. If the port is not the default 3306, you need to add the -P parameter to specify the port number, such as mysql-uroot-p-h192.168.1.100-P3307; In addition, if you encounter a password error, you can re-enter it. If the connection fails, check the network, firewall or permission settings. If the client is missing, you can install mysql-client on Linux through the package manager. Master these commands
Why do indexes improve MySQL query speed?
Jun 19, 2025 am 01:05 AM
IndexesinMySQLimprovequeryspeedbyenablingfasterdataretrieval.1.Theyreducedatascanned,allowingMySQLtoquicklylocaterelevantrowsinWHEREorORDERBYclauses,especiallyimportantforlargeorfrequentlyqueriedtables.2.Theyspeedupjoinsandsorting,makingJOINoperation
What are the transaction isolation levels in MySQL, and which is the default?
Jun 23, 2025 pm 03:05 PM
MySQL's default transaction isolation level is RepeatableRead, which prevents dirty reads and non-repeatable reads through MVCC and gap locks, and avoids phantom reading in most cases; other major levels include read uncommitted (ReadUncommitted), allowing dirty reads but the fastest performance, 1. Read Committed (ReadCommitted) ensures that the submitted data is read but may encounter non-repeatable reads and phantom readings, 2. RepeatableRead default level ensures that multiple reads within the transaction are consistent, 3. Serialization (Serializable) the highest level, prevents other transactions from modifying data through locks, ensuring data integrity but sacrificing performance;
How to safely purge old MySQL binlog files?
Jun 19, 2025 am 01:01 AM
To clean MySQL binlog files, you should use the PURGEBINARYLOGS command or set the automatic expiration time, and files cannot be deleted directly. 1. Use the PURGE command to clean old logs by file name or time. Before execution, you need to confirm that the slave library no longer uses the relevant logs; 2. Check the current log status and slave library location through SHOWMASTERSTATUS and SHOWSLAVESTATUS to ensure the security of the cleaning range; 3. It is recommended to set the binlog_expire_logs_seconds parameter to achieve automatic cleaning, which is suitable for long-term operation environments; 4. Deleting files directly will cause serious problems such as master-slave synchronization failure and inconsistent log information, and must be avoided.
How to add the MySQL bin directory to the system PATH
Jul 01, 2025 am 01:39 AM
To add MySQL's bin directory to the system PATH, it needs to be configured according to the different operating systems. 1. Windows system: Find the bin folder in the MySQL installation directory (the default path is usually C:\ProgramFiles\MySQL\MySQLServerX.X\bin), right-click "This Computer" → "Properties" → "Advanced System Settings" → "Environment Variables", select Path in "System Variables" and edit it, add the MySQLbin path, save it and restart the command prompt and enter mysql--version verification; 2.macOS and Linux systems: Bash users edit ~/.bashrc or ~/.bash_
How to install MySQL on Windows 11
Jun 29, 2025 am 01:47 AM
The key steps for installing MySQL on Windows 11 are as follows: 1. Download the correct version, select the Windows MSI installation package and ensure that the system is 64-bit; 2. Select the "Custom" mode during installation, add MySQLServer and set the appropriate installation path; 3. Run the configuration wizard, select the "ServerComputer" configuration type, set the root password, and select the automatic startup method; 4. After the test installation is successful, if the prompt command is unavailable, add the MySQL bin directory to the system PATH environment variable. Follow these steps to complete the installation and configuration smoothly.
Resetting the root password for MySQL server
Jul 03, 2025 am 02:32 AM
To reset the root password of MySQL, please follow the following steps: 1. Stop the MySQL server, use sudosystemctlstopmysql or sudosystemctlstopmysqld; 2. Start MySQL in --skip-grant-tables mode, execute sudomysqld-skip-grant-tables&; 3. Log in to MySQL and execute the corresponding SQL command to modify the password according to the version, such as FLUSHPRIVILEGES;ALTERUSER'root'@'localhost'IDENTIFIEDBY'your_new
