Mysql generates secret key specific steps through SSL _mysql

--MySQL SSL generated secret key
1 Check SSL is turned on
Mysql> Show variables like '%ssl% ';
+---------------+----------+
| variable_name | Value |
+---------------+----------+
| Have_openssl | DISABLED |
| Have_ssl | DISABLED |
| Ssl_ca | |
| Ssl_capath | |
| Ssl_cert | |
| Ssl_cipher | |
| SSL_CRL | |
| Ssl_crlpath | |
| Ssl_key | |
+---------------+----------+
9 Rows in Set (0.00 sec)

2 is not turned on, so open
Set the SSL parameters at the end of the my.cnf and restart the MySQL service
Mysql> Show variables like '%ssl% ';
+---------------+-------+
| variable_name | Value |
+---------------+-------+
| Have_openssl | YES |
| Have_ssl | YES |
| Ssl_ca | |
| Ssl_capath | |
| Ssl_cert | |
| Ssl_cipher | |
| SSL_CRL | |
| Ssl_crlpath | |
| Ssl_key | |
+---------------+-------+
9 Rows in Set (0.00 sec)

3 Generate a secret key on MySQL DB server by OpenSSL the configuration of the certificate
Mkdir-p/etc/mysql/newcerts/
cd/etc/mysql/newcerts/
3.1 OpenSSL Genrsa 2048 > Ca-key.pem
3.2 OpenSSL req-new-x509-nodes-days 1000-key ca-key.pem > Ca-cert.pem
[Root@mysql newcerts]# OpenSSL req-new-x509-nodes-days 1000-key ca-key.pem > Ca-cert.pem
are about to is asked to enter information that would be incorporated
into your certificate request.
What you are about to enter the What is called a distinguished Name or a DN.
There are quite a few fields but you can leave some
For some fields there would be a default value,
If you enter '. ', the field would be left blank.
-----
Country Name (2 letter code) [Xx]:ch
State or province Name (full name) []:shh
Locality Name (eg, city) [Default city]:shh
Organization Name (eg, company) [Default company Ltd]:xx
Organizational unit Name (eg, section) []:d b
Common name (eg, your name or your server ' s hostname) []:mysql.yest.nos
Email Address []:xx@xx.com
3.3 OpenSSL Req-newkey rsa:2048-days 1000-nodes-keyout server-key.pem > Server-req.pem
[Root@mysql newcerts]# OpenSSL req-newkey rsa:2048-days 1000-nodes-keyout server-key.pem > Server-req.pem
Generating a 2048 bit RSA private key
.......................................................................................................+++
..........................................................+++
Writing new private key to ' Server-key.pem '
-----
are about to is asked to enter information that would be incorporated
into your certificate request.
What you are about to enter the What is called a distinguished Name or a DN.
There are quite a few fields but you can leave some
For some fields there would be a default value,
If you enter '. ', the field would be left blank.
-----
Country Name (2 letter code) [Xx]:ch
State or province Name (full name) []:shh
Locality Name (eg, city) [Default city]:ssh
Organization Name (eg, company) [Default company Ltd]:xx
Organizational unit Name (eg, section) []:d b
Common name (eg, your name or your server ' s hostname) []:mysql.yest.nos
Email Address []:xx@xx.com
Please enter the following ' extra ' attributes
To is sent with your certificate request
A Challenge Password []:820923
An optional company name []:xx

4 Generating SSL files on MySQL DB server clients
4.1 OpenSSL x509-req-in server-req.pem-days 1000-ca ca-cert.pem-cakey ca-key.pem-set_serial > Server-cert.pem
[Root@mysql newcerts]# OpenSSL x509-req-in server-req.pem-days 1000-ca ca-cert.pem-cakey ca-key.pem-set_serial-&G T Server-cert.pem
Signature OK
Subject=/c=ch/st=shh/l=ssh/o=ea/ou=db/cn=mysql.yest.nos/emailaddress=cm@xx.com
Getting CA Private Key
4.2 OpenSSL Req-newkey rsa:2048-days 1000-nodes-keyout client-key.pem > Client-req.pem
[Root@mysql newcerts]# OpenSSL req-newkey rsa:2048-days 1000-nodes-keyout client-key.pem > Client-req.pem
Generating a 2048 bit RSA private key
.......+++
........................................................+++
Writing new private key to ' Client-key.pem '
-----
are about to is asked to enter information that would be incorporated
into your certificate request.
What you are about to enter the What is called a distinguished Name or a DN.
There are quite a few fields but you can leave some
For some fields there would be a default value,
If you enter '. ', the field would be left blank.
-----
Country Name (2 letter code) [Xx]:ch
State or province Name (full name) []:shh
Locality Name (eg, city) [Default city]:shh
Organization Name (eg, company) [Default company Ltd]:xx
Organizational unit Name (eg, section) []:d b
Common name (eg, your name or your server ' s hostname) []:mysql.yest.nos
Email Address []:cx@xx.com
Please enter the following ' extra ' attributes
To is sent with your certificate request
A Challenge Password []:820923
An optional company name []:xx
4.3
OpenSSL x509-req-in client-req.pem-days 1000-ca ca-cert.pem-cakey ca-key.pem-set_serial > Client-cert.pem
[Root@mysql newcerts]# OpenSSL x509-req-in client-req.pem-days 1000-ca ca-cert.pem-cakey ca-key.pem-set_serial-&G T Client-cert.pem
Signature OK
Subject=/c=ch/st=shh/l=shh/o=ea/ou=db/cn=mysql.yest.nos/emailaddress=cm@xx.com
Getting CA Private Key

5
[]copy clent.* 3 files to the client machine/opt/mysql/ssl/go.

6 Login Verification
Mysql-uxxx-pxxxx--ssl-ca=/opt/mysql/ssl/ca-cert.pem--ssl-cert=/opt/mysql/ssl/server-cert.pem--ssl-key=/opt/ Mysql/ssl/server-key.pem
Conferce:http://www.docin.com/p-151590189.html