Commit 9cd207e0 authored by tonu@x153.internalnet's avatar tonu@x153.internalnet

OpenSSL fixes

parent 2d37fa27
Quick notes:
--------------------------------------------
[tonu@x153 mysql-4.0]$ cat /etc/my.cnf
[mysqld]
ssl-ca=SSL/cacert.pem
ssl-cert=SSL/server-cert.pem
ssl-key=SSL/server-key.pem
[mysql]
ssl-ca=SSL/cacert.pem
ssl-cert=SSL/client-cert.pem
ssl-key=SSL/client-key.pem
[mysqldump]
ssl-ca=SSL/cacert.pem
ssl-cert=SSL/client-cert.pem
ssl-key=SSL/client-key.pem
[tonu@x153 mysql-4.0]$
--------------------------------------------
To remove passwords from keyfiles:
[tonu@x153 SSL]$ openssl rsa -inform pem < server-req.pem > server-key.pem
read RSA key
Enter PEM pass phrase:
......@@ -12,12 +28,10 @@ writing RSA key
To run server:
sql/mysqld --ssl-ca=SSL/cacert.pem --ssl-cert=SSL/server-cert.pem --ssl-key=SSL/server-key.pem --skip-grant --debug='d:t:O,-' > /tmp/mysqld.trace
--------------------------------------------
To run client:
client/mysql --ssl-ca=SSL/cacert.pem --ssl-cert=SSL/server-cert.pem --ssl-key=SSL/server-key.pem --debug='d:t:O,/tmp/client.trace' -h 127.0.0.1
--------------------------------------------
openssl s_client -host 127.0.0.1 -port 1111 -debug -verify 1 -cert ../SSL/client-cert.pem -key ../SSL/client-key.pem -CAfile ../SSL/cacert.pem -pause -showcerts -state
......@@ -27,8 +41,9 @@ openssl s_server -port 1111 -cert ../SSL/server-cert.pem -key ../SSL/server-key.
--------------------------------------------
CA stuff:
[tonu@x153 bin]$ pwd
/usr/local/ssl/bin
......
-- require r/have_ssl.require
show variables like "have_ssl";
-- require r/have_openssl.require
show variables like "have_openssl";
-- source include/have_openssl.inc
# We want to test everything with SSL turned on.
-- source include/have_openssl.inc
SHOW STATUS LIKE 'SSL%';
......@@ -202,9 +202,9 @@ SHOW_COMP_OPTION have_raid=SHOW_OPTION_YES;
SHOW_COMP_OPTION have_raid=SHOW_OPTION_NO;
#endif
#ifdef HAVE_OPENSSL
SHOW_COMP_OPTION have_ssl=SHOW_OPTION_YES;
SHOW_COMP_OPTION have_openssl=SHOW_OPTION_YES;
#else
SHOW_COMP_OPTION have_ssl=SHOW_OPTION_NO;
SHOW_COMP_OPTION have_openssl=SHOW_OPTION_NO;
#endif
SHOW_COMP_OPTION have_symlink=SHOW_OPTION_YES;
......@@ -2894,7 +2894,7 @@ struct show_var_st init_vars[]= {
{"have_isam", (char*) &have_isam, SHOW_HAVE},
{"have_raid", (char*) &have_raid, SHOW_HAVE},
{"have_symlink", (char*) &have_symlink, SHOW_HAVE},
{"have_ssl", (char*) &have_ssl, SHOW_HAVE},
{"have_openssl", (char*) &have_openssl, SHOW_HAVE},
{"init_file", (char*) &opt_init_file, SHOW_CHAR_PTR},
#ifdef HAVE_INNOBASE_DB
{"innodb_data_file_path", (char*) &innobase_data_file_path, SHOW_CHAR_PTR},
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment