MySQL5.6 創(chuàng)建SSL文件方法
成都創(chuàng)新互聯公司從2013年開始,先為尤溪等服務建站,尤溪等地企業(yè),進行企業(yè)商務咨詢服務。為尤溪企業(yè)網站制作PC+手機+微官網三網同步一站式服務解決您的所有建站問題。官方文檔:https://dev.mysql.com/doc/refman/5.6/en/creating-ssl-files-using-openssl.html#creating-ssl-files-using-openssl-unix-command-line
Create clean environment
mkdir /home/mysql/mysqlcerts && cd /home/mysql/mysqlcerts
Create CA certificate
openssl genrsa 2048 > ca-key.pem
openssl req -new -x509 -nodes -days 3600 -key ca-key.pem -out ca.pem
Create server certificate, remove passphrase, and sign it
server-cert.pem = public key, server-key.pem = private key
openssl req -newkey rsa:2048 -days 3600 -nodes -keyout server-key.pem -out server-req.pem
openssl rsa -in server-key.pem -out server-key.pem
openssl x509 -req -in server-req.pem -days 3600 -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem
Create client certificate, remove passphrase, and sign it
client-cert.pem = public key, client-key.pem = private key
openssl req -newkey rsa:2048 -days 3600 -nodes -keyout client-key.pem -out client-req.pem
openssl rsa -in client-key.pem -out client-key.pem
openssl x509 -req -in client-req.pem -days 3600 -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out client-cert.pem
openssl verify -CAfile ca.pem server-cert.pem client-cert.pem
server-cert.pem: OK
client-cert.pem: OK
MySQL5.7 創(chuàng)建SSL文件方法
官方文檔:https://dev.mysql.com/doc/refman/5.7/en/creating-ssl-rsa-files-using-mysql.html
mkdir -p /home/mysql/mysqlcerts
/usr/local/mysql-5.7.21-linux-glibc2.12-x86_64/bin/mysql_ssl_rsa_setup --datadir=/home/mysql/mysqlcerts/
主庫創(chuàng)建SSL后進行配置
從庫 192.168.1.222
mkdir -p /home/mysql/mysqlcerts
主庫
chown -R mysql.mysql /home/mysql/mysqlcerts/
scp ca.pem client-cert.pem client-key.pem root@192.168.1.222:/home/mysql/mysqlcerts/
主庫授權
GRANT REPLICATION SLAVE ON *.* TO 'repl'@'192.168.1.222' identified by '' require ssl;
主庫 my.cnf
#SSL
ssl-ca=/home/mysql/mysqlcerts/ca.pem
ssl-cert=/home/mysql/mysqlcerts/server-cert.pem
ssl-key=/home/mysql/mysqlcerts/server-key.pem
restart mysql
從庫
chown -R mysql.mysql /home/mysql/mysqlcerts/
my.cnf
ssl-ca=/home/mysql/mysqlcerts/ca.pem
ssl-cert= /home/mysql/mysqlcerts/client-cert.pem
ssl-key= /home/mysql/mysqlcerts/client-key.pem
創(chuàng)建復制:
change master to master_host='',master_user='',master_password='',master_log_file='mysql-bin.000001',master_log_pos=154, master_ssl=1, master_ssl_ca='/home/mysql/mysqlcerts/ca.pem', master_ssl_cert='/home/mysql/mysqlcerts/client-cert.pem', master_ssl_key='/home/mysql/mysqlcerts/client-key.pem' ,MASTER_CONNECT_RETRY=10;
驗證:
主庫配置SSL認證后,客戶端默認以SSL方式登錄
mysql -utest -h292.168.1.223 -ptest -P3307
(該賬號不論是否配置require ssl 均能登錄)
不以SSL方式登錄命令為:
mysql -utest -h292.168.1.223 -ptest -P3307 --ssl-mode=DISABLED
(如該賬號配置了require ssl 則無法登錄)
另外有需要云服務器可以了解下創(chuàng)新互聯scvps.cn,海內外云服務器15元起步,三天無理由+7*72小時售后在線,公司持有idc許可證,提供“云服務器、裸金屬服務器、高防服務器、香港服務器、美國服務器、虛擬主機、免備案服務器”等云主機租用服務以及企業(yè)上云的綜合解決方案,具有“安全穩(wěn)定、簡單易用、服務可用性高、性價比高”等特點與優(yōu)勢,專為企業(yè)上云打造定制,能夠滿足用戶豐富、多元化的應用場景需求。
本文題目:MySQL配置SSL主從復制-創(chuàng)新互聯
標題網址:http://jinyejixie.com/article4/hgcie.html
成都網站建設公司_創(chuàng)新互聯,為您提供企業(yè)網站制作、定制網站、網站設計、全網營銷推廣、網站設計公司、軟件開發(fā)
聲明:本網站發(fā)布的內容(圖片、視頻和文字)以用戶投稿、用戶轉載內容為主,如果涉及侵權請盡快告知,我們將會在第一時間刪除。文章觀點不代表本網站立場,如需處理請聯系客服。電話:028-86922220;郵箱:631063699@qq.com。內容未經允許不得轉載,或轉載時需注明來源: 創(chuàng)新互聯