Configuration of SSL connections for private CAs and MySQL servers using OpenSSL
I. INTRODUCTION of CA
The CA also has a certificate (with public and private keys included). Public users on the Internet trust the CA by verifying the CA's signature, and anyone can get the CA's certificate (with the public key) to verify the certificate it has issued.
If a user wants a certificate that belongs to him, he should apply to the CA first. After the CA has identified the applicant, he is assigned a public key, and the CA binds the public key to the applicant's identity and signs it, then forms a certificate to the applicant.
If a user wants to authenticate the authenticity of another certificate, he verifies the signature on that certificate with the CA's public key, which is considered valid once the authentication is passed. The certificate is actually the authentication of the user's public key issued by the certificate Visa Authority (CA).
The contents of the certificate include: information of the electronic visa office, public key user information, public key, signature and expiration date of the authority, etc. At present, the format and verification methods of certificates generally follow the international standard.
Ii. using OpenSSL to implement a private CA
Lab Environment:
System--rhel5.8
Software--openssl
Specific steps:
1. Pre-preparation (all of the following are done in the/etc/pki/ca/directory)
[Email protected] ~]# cd/etc/pki/ca/
2. Modify the configuration file
[Email protected] ca]# vim. /tls/openssl.cnf
3. Find the appropriate parameters to modify
650) this.width=650; "src=" Http://s5.51cto.com/wyfs02/M01/77/3B/wKiom1ZlfdKDk42HAAAp-FIwUIA086.png "title=" 1.png " alt= "Wkiom1zlfdkdk42haaap-fiwuia086.png"/>
4. Create the appropriate directories and files in the CA directory
650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M00/77/3B/wKiom1Zlfp_wyTrIAAAJLiNC5L4115.png "title=" 2.png " alt= "Wkiom1zlfp_wytriaaajlinc5l4115.png"/>
5. Create a private key
650) this.width=650; "src=" Http://s1.51cto.com/wyfs02/M00/77/3A/wKioL1Zlf-eiM1nEAAAPj02mNOE926.png "title=" 4.png " alt= "Wkiol1zlf-eim1neaaapj02mnoe926.png"/>
6. Generate a self-signed certificate
650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M01/77/3C/wKiom1ZlgR-RNMb9AAAvfWi11aA243.png "title=" 6.png " alt= "Wkiom1zlgr-rnmb9aaavfwi11aa243.png"/>
Note: When you fill out the corresponding sub-certificate from the country to the organization should be required to sign the same.
Third, configure MySQL
1. Configure the implementation of MySQL using SSL connection
650) this.width=650; "src=" Http://s4.51cto.com/wyfs02/M02/77/3E/wKiom1ZliGmDa1UCAAAVvUpoLqA740.png "title=" 8.png " alt= "Wkiom1zligmda1ucaaavvupolqa740.png"/> If MySQL uses show variables like '%ssl% ' and shows as above, it proves that the SSL connection is supported.
2. Establish the MySQL private key and the corresponding certificate
650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M02/77/3E/wKiom1ZligHw8PIaAAAPBbnSUU4763.png "style=" float: none; "title=" 9.png "alt=" Wkiom1zlighw8piaaaapbbnsuu4763.png "/>
650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M02/77/3C/wKioL1ZlinDALJrlAAAmnhYBqIw746.png "style=" float: none; "title=" 10.png "alt=" Wkiol1zlindaljrlaaamnhybqiw746.png "/>
650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M02/77/3E/wKiom1ZlilWhsbA3AAAzUO3vbz8220.png "title=" 11.png "alt=" Wkiom1zlilwhsba3aaazuo3vbz8220.png "/>3. Copy Cacert.pem, and modify the appropriate permissions
650) this.width=650; "src=" Http://s4.51cto.com/wyfs02/M01/77/3E/wKiom1Zlit3DqB29AAAZBfTprs0966.png "title=" 12.png "alt=" Wkiom1zlit3dqb29aaazbftprs0966.png "/>4. Modify the MySQL configuration file and add the diagram content to the MYSQLD segment
650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M02/77/3C/wKioL1ZljBDCxdFsAAANM8JfBl4166.png "title=" 13.png "alt=" Wkiol1zljbdcxdfsaaanm8jfbl4166.png "/>5. Restart the MySQL server, the configuration is successful
650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M01/77/3C/wKioL1ZljNOiyltXAAAnFLIiets825.png "title=" 15.png "alt=" Wkiol1zljnoiyltxaaanfliiets825.png "/>6. Login to create a corresponding MySQL user
650) this.width=650; "src=" Http://s5.51cto.com/wyfs02/M02/77/3E/wKiom1ZljMWxo0IZAAAE8hcrH-o936.png "title=" 16.png "alt=" Wkiom1zljmwxo0izaaae8hcrh-o936.png "/>7. Login must be on another Linux host, configure the appropriate client private key and certificate and use the following options
650) this.width=650; "src=" Http://s4.51cto.com/wyfs02/M01/77/3D/wKioL1ZljcqhlpATAAAGRnqCnSI421.png "title=" 19.png This concludes the "alt=" Wkiol1zljcqhlpataaagrnqcnsi421.png "/> Tutorial.
Configuration of SSL connections for private CAs and MySQL servers using OpenSSL