Configuration of SSL connections for private CAs and MySQL servers using OpenSSL

Source: Internet
Author: User
Tags cas openssl ssl connection

Configuration of SSL connections for private CAs and MySQL servers using OpenSSL

I. INTRODUCTION of CA

The CA also has a certificate (with public and private keys included). Public users on the Internet trust the CA by verifying the CA's signature, and anyone can get the CA's certificate (with the public key) to verify the certificate it has issued.

If a user wants a certificate that belongs to him, he should apply to the CA first. After the CA has identified the applicant, he is assigned a public key, and the CA binds the public key to the applicant's identity and signs it, then forms a certificate to the applicant.

If a user wants to authenticate the authenticity of another certificate, he verifies the signature on that certificate with the CA's public key, which is considered valid once the authentication is passed. The certificate is actually the authentication of the user's public key issued by the certificate Visa Authority (CA).

The contents of the certificate include: information of the electronic visa office, public key user information, public key, signature and expiration date of the authority, etc. At present, the format and verification methods of certificates generally follow the international standard.

Ii. using OpenSSL to implement a private CA

Lab Environment:

System--rhel5.8

Software--openssl

Specific steps:

1. Pre-preparation (all of the following are done in the/etc/pki/ca/directory)

[Email protected] ~]# cd/etc/pki/ca/

2. Modify the configuration file

[Email protected] ca]# vim. /tls/openssl.cnf

3. Find the appropriate parameters to modify

650) this.width=650; "src=" Http://s5.51cto.com/wyfs02/M01/77/3B/wKiom1ZlfdKDk42HAAAp-FIwUIA086.png "title=" 1.png " alt= "Wkiom1zlfdkdk42haaap-fiwuia086.png"/>

4. Create the appropriate directories and files in the CA directory

650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M00/77/3B/wKiom1Zlfp_wyTrIAAAJLiNC5L4115.png "title=" 2.png " alt= "Wkiom1zlfp_wytriaaajlinc5l4115.png"/>

5. Create a private key

650) this.width=650; "src=" Http://s1.51cto.com/wyfs02/M00/77/3A/wKioL1Zlf-eiM1nEAAAPj02mNOE926.png "title=" 4.png " alt= "Wkiol1zlf-eim1neaaapj02mnoe926.png"/>

6. Generate a self-signed certificate

650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M01/77/3C/wKiom1ZlgR-RNMb9AAAvfWi11aA243.png "title=" 6.png " alt= "Wkiom1zlgr-rnmb9aaavfwi11aa243.png"/>

Note: When you fill out the corresponding sub-certificate from the country to the organization should be required to sign the same.

Third, configure MySQL

1. Configure the implementation of MySQL using SSL connection

650) this.width=650; "src=" Http://s4.51cto.com/wyfs02/M02/77/3E/wKiom1ZliGmDa1UCAAAVvUpoLqA740.png "title=" 8.png " alt= "Wkiom1zligmda1ucaaavvupolqa740.png"/> If MySQL uses show variables like '%ssl% ' and shows as above, it proves that the SSL connection is supported.

2. Establish the MySQL private key and the corresponding certificate

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M02/77/3E/wKiom1ZligHw8PIaAAAPBbnSUU4763.png "style=" float: none; "title=" 9.png "alt=" Wkiom1zlighw8piaaaapbbnsuu4763.png "/>

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M02/77/3C/wKioL1ZlinDALJrlAAAmnhYBqIw746.png "style=" float: none; "title=" 10.png "alt=" Wkiol1zlindaljrlaaamnhybqiw746.png "/>

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M02/77/3E/wKiom1ZlilWhsbA3AAAzUO3vbz8220.png "title=" 11.png "alt=" Wkiom1zlilwhsba3aaazuo3vbz8220.png "/>3. Copy Cacert.pem, and modify the appropriate permissions

650) this.width=650; "src=" Http://s4.51cto.com/wyfs02/M01/77/3E/wKiom1Zlit3DqB29AAAZBfTprs0966.png "title=" 12.png "alt=" Wkiom1zlit3dqb29aaazbftprs0966.png "/>4. Modify the MySQL configuration file and add the diagram content to the MYSQLD segment

650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M02/77/3C/wKioL1ZljBDCxdFsAAANM8JfBl4166.png "title=" 13.png "alt=" Wkiol1zljbdcxdfsaaanm8jfbl4166.png "/>5. Restart the MySQL server, the configuration is successful

650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M01/77/3C/wKioL1ZljNOiyltXAAAnFLIiets825.png "title=" 15.png "alt=" Wkiol1zljnoiyltxaaanfliiets825.png "/>6. Login to create a corresponding MySQL user

650) this.width=650; "src=" Http://s5.51cto.com/wyfs02/M02/77/3E/wKiom1ZljMWxo0IZAAAE8hcrH-o936.png "title=" 16.png "alt=" Wkiom1zljmwxo0izaaae8hcrh-o936.png "/>7. Login must be on another Linux host, configure the appropriate client private key and certificate and use the following options

650) this.width=650; "src=" Http://s4.51cto.com/wyfs02/M01/77/3D/wKioL1ZljcqhlpATAAAGRnqCnSI421.png "title=" 19.png This concludes the "alt=" Wkiol1zljcqhlpataaagrnqcnsi421.png "/> Tutorial.

Configuration of SSL connections for private CAs and MySQL servers using OpenSSL

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.