Configuration of SSL connections for private CAs and MySQL servers using OpenSSL

Configuration of SSL connections for private CAs and MySQL servers using OpenSSL

I. INTRODUCTION of CA

The CA also has a certificate (with public and private keys included). Public users on the Internet trust the CA by verifying the CA's signature, and anyone can get the CA's certificate (with the public key) to verify the certificate it has issued.

If a user wants a certificate that belongs to him, he should apply to the CA first. After the CA has identified the applicant, he is assigned a public key, and the CA binds the public key to the applicant's identity and signs it, then forms a certificate to the applicant.

If a user wants to authenticate the authenticity of another certificate, he verifies the signature on that certificate with the CA's public key, which is considered valid once the authentication is passed. The certificate is actually the authentication of the user's public key issued by the certificate Visa Authority (CA).

The contents of the certificate include: information of the electronic visa office, public key user information, public key, signature and expiration date of the authority, etc. At present, the format and verification methods of certificates generally follow the international standard.

Ii. using OpenSSL to implement a private CA

Lab Environment:

System--rhel5.8

Software--openssl

Specific steps:

1. Pre-preparation (all of the following are done in the/etc/pki/ca/directory)

[Email protected] ~]# cd/etc/pki/ca/

2. Modify the configuration file

[Email protected] ca]# vim. /tls/openssl.cnf

3. Find the appropriate parameters to modify

650) this.width=650; "src=" Http://s5.51cto.com/wyfs02/M01/77/3B/wKiom1ZlfdKDk42HAAAp-FIwUIA086.png "title=" 1.png " alt= "Wkiom1zlfdkdk42haaap-fiwuia086.png"/>

4. Create the appropriate directories and files in the CA directory

650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M00/77/3B/wKiom1Zlfp_wyTrIAAAJLiNC5L4115.png "title=" 2.png " alt= "Wkiom1zlfp_wytriaaajlinc5l4115.png"/>

5. Create a private key

650) this.width=650; "src=" Http://s1.51cto.com/wyfs02/M00/77/3A/wKioL1Zlf-eiM1nEAAAPj02mNOE926.png "title=" 4.png " alt= "Wkiol1zlf-eim1neaaapj02mnoe926.png"/>

6. Generate a self-signed certificate

650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M01/77/3C/wKiom1ZlgR-RNMb9AAAvfWi11aA243.png "title=" 6.png " alt= "Wkiom1zlgr-rnmb9aaavfwi11aa243.png"/>

Note: When you fill out the corresponding sub-certificate from the country to the organization should be required to sign the same.

Third, configure MySQL

1. Configure the implementation of MySQL using SSL connection

650) this.width=650; "src=" Http://s4.51cto.com/wyfs02/M02/77/3E/wKiom1ZliGmDa1UCAAAVvUpoLqA740.png "title=" 8.png " alt= "Wkiom1zligmda1ucaaavvupolqa740.png"/> If MySQL uses show variables like '%ssl% ' and shows as above, it proves that the SSL connection is supported.

2. Establish the MySQL private key and the corresponding certificate

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M02/77/3E/wKiom1ZligHw8PIaAAAPBbnSUU4763.png "style=" float: none; "title=" 9.png "alt=" Wkiom1zlighw8piaaaapbbnsuu4763.png "/>

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M02/77/3C/wKioL1ZlinDALJrlAAAmnhYBqIw746.png "style=" float: none; "title=" 10.png "alt=" Wkiol1zlindaljrlaaamnhybqiw746.png "/>

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M02/77/3E/wKiom1ZlilWhsbA3AAAzUO3vbz8220.png "title=" 11.png "alt=" Wkiom1zlilwhsba3aaazuo3vbz8220.png "/>3. Copy Cacert.pem, and modify the appropriate permissions

650) this.width=650; "src=" Http://s4.51cto.com/wyfs02/M01/77/3E/wKiom1Zlit3DqB29AAAZBfTprs0966.png "title=" 12.png "alt=" Wkiom1zlit3dqb29aaazbftprs0966.png "/>4. Modify the MySQL configuration file and add the diagram content to the MYSQLD segment

650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M02/77/3C/wKioL1ZljBDCxdFsAAANM8JfBl4166.png "title=" 13.png "alt=" Wkiol1zljbdcxdfsaaanm8jfbl4166.png "/>5. Restart the MySQL server, the configuration is successful

650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M01/77/3C/wKioL1ZljNOiyltXAAAnFLIiets825.png "title=" 15.png "alt=" Wkiol1zljnoiyltxaaanfliiets825.png "/>6. Login to create a corresponding MySQL user

650) this.width=650; "src=" Http://s5.51cto.com/wyfs02/M02/77/3E/wKiom1ZljMWxo0IZAAAE8hcrH-o936.png "title=" 16.png "alt=" Wkiom1zljmwxo0izaaae8hcrh-o936.png "/>7. Login must be on another Linux host, configure the appropriate client private key and certificate and use the following options

650) this.width=650; "src=" Http://s4.51cto.com/wyfs02/M01/77/3D/wKioL1ZljcqhlpATAAAGRnqCnSI421.png "title=" 19.png This concludes the "alt=" Wkiol1zljcqhlpataaagrnqcnsi421.png "/> Tutorial.

Configuration of SSL connections for private CAs and MySQL servers using OpenSSL