{"id":2411,"date":"2017-06-29T22:37:03","date_gmt":"2017-06-29T14:37:03","guid":{"rendered":"http:\/\/cn.hostease.com\/xueyuan\/?p=2411"},"modified":"2025-01-15T15:03:20","modified_gmt":"2025-01-15T07:03:20","slug":"mysql-5-7-ssl%e8%bf%9e%e6%8e%a5%e6%9c%80%e4%bd%b3%e5%ae%9e%e6%88%98","status":"publish","type":"post","link":"https:\/\/cn.hostease.com\/xueyuan\/jishu\/shujuku\/mysql-5-7-ssl%e8%bf%9e%e6%8e%a5%e6%9c%80%e4%bd%b3%e5%ae%9e%e6%88%98\/","title":{"rendered":"MySQL 5.7——–SSL\u8fde\u63a5\u6700\u4f73\u5b9e\u6218"},"content":{"rendered":"\n

1. \u80cc\u666f<\/strong><\/p>\n\n\n\n

* \u5728\u751f\u4ea7\u73af\u5883\u4e0b\uff0c\u5b89\u5168\u603b\u662f\u65e0\u6cd5\u5ffd\u89c6\u7684\u95ee\u9898\uff0c\u6570\u636e\u5e93\u5b89\u5168\u5219\u662f\u91cd\u4e2d\u4e4b\u91cd\uff0c\u56e0\u4e3a\u6240\u6709\u7684\u6570\u636e\u90fd\u5b58\u653e\u5728\u6570\u636e\u5e93\u4e2d<\/p>\n\n\n\n

* \u5f53\u4f7f\u7528\u975e\u52a0\u5bc6\u65b9\u5f0f\u8fde\u63a5MySQL\u6570\u636e\u5e93\u65f6\uff0c\u5728\u7f51\u7edc\u4e2d\u4f20\u8f93\u7684\u6240\u6709\u4fe1\u606f\u90fd\u662f\u660e\u6587\u7684\uff0c\u53ef\u4ee5\u88ab\u7f51\u7edc\u4e2d\u6240\u6709\u4eba\u622a\u53d6\uff0c\u654f\u611f\u4fe1\u606f\u53ef\u80fd\u88ab\u6cc4\u9732\u3002\u5728\u4f20\u9001\u654f\u611f\u4fe1\u606f\uff08\u5982\u5bc6\u7801\uff09\u65f6\uff0c\u53ef\u4ee5\u91c7\u7528SSL\u8fde\u63a5\u7684\u65b9\u5f0f\u3002<\/p>\n\n\n\n

*  \u7248\u672c\u5c0f\u4e8e5.7.6\u65f6\u6309\u7167 MySQL 5.6 SSL\u914d\u7f6e\u7684\u65b9\u5f0f\u8fdb\u884c\u3002<\/p>\n\n\n\n

2. MySQL \u8fde\u63a5\u65b9\u5f0f<\/strong><\/p>\n\n\n\n

* socket\u8fde\u63a5<\/p>\n\n\n\n

* TCP\u975eSSL\u8fde\u63a5<\/p>\n\n\n\n

* SSL\u5b89\u5168\u8fde\u63a5<\/p>\n\n\n\n

* SSL + \u5bc6\u7801\u8fde\u63a5 [version > MySQL 5.7.5]<\/p>\n\n\n\n

* SSL + \u5bc6\u7801 + \u5bc6\u94a5\u8fde\u63a5<\/p>\n\n\n\n

3. SSL \u7b80\u4ecb<\/strong><\/p>\n\n\n\n

* SSL\u6307\u7684\u662fSSL\/TLS\uff0c\u5176\u662f\u4e00\u79cd\u4e3a\u4e86\u5728\u8ba1\u7b97\u673a\u7f51\u7edc\u8fdb\u884c\u5b89\u5168\u901a\u4fe1\u7684\u52a0\u5bc6\u534f\u8bae\u3002\u5047\u8bbe\u7528\u6237\u7684\u4f20\u8f93\u4e0d\u662f\u901a\u8fc7SSL\u7684\u65b9\u5f0f\uff0c\u90a3\u4e48\u5176\u5728\u7f51\u7edc\u4e2d\u4ee5\u660e\u6587\u7684\u65b9\u5f0f\u8fdb\u884c\u4f20\u8f93\uff0c\u800c\u8fd9\u7ed9\u522b\u6709\u7528\u5fc3\u7684\u4eba\u5e26\u6765\u4e86\u53ef\u4e58\u4e4b\u673a\u3002\u6240\u4ee5\uff0c\u73b0\u5728\u5f88\u591a\u7f51\u7ad9\u5176\u5b9e\u9ed8\u8ba4\u5df2\u7ecf\u5f00\u542f\u4e86SSL\u529f\u80fd\uff0c\u6bd4\u5982Facebook\u3001Twtter\u3001YouTube\u3001\u6dd8\u5b9d\u7b49\u3002<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

4. \u73af\u5883 [ \u5173\u95edSeLinux ]<\/strong><\/p>\n\n\n\n

* system \u73af\u5883<\/p>\n\n\n\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n<\/td>\n
\n
\n
[root@MySQL ~]<\/code># cat \/etc\/redhat-release <\/code><\/div>\n
CentOS release 6.9 (Final)<\/code><\/div>\n
[root@MySQL ~]<\/code># uname -r<\/code><\/div>\n
 <\/div>\n
2.6.32-696.3.2.el6.x86_64<\/code><\/div>\n
 <\/div>\n
[root@MySQL ~]<\/code># getenforce <\/code><\/div>\n
Disabled<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n\n\n\n

 <\/p>\n\n\n\n

have_openssl \u4e0e have_ssl \u503c\u90fd\u4e3aDISABLED\u8868\u793assl\u672a\u5f00\u542f<\/strong><\/p>\n\n\n\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n
15<\/div>\n
16<\/div>\n
17<\/div>\n
18<\/div>\n
19<\/div>\n
20<\/div>\n
21<\/div>\n
22<\/div>\n
23<\/div>\n
24<\/div>\n
25<\/div>\n
26<\/div>\n
27<\/div>\n
28<\/div>\n
29<\/div>\n
30<\/div>\n
31<\/div>\n
32<\/div>\n
33<\/div>\n
34<\/div>\n
35<\/div>\n
36<\/div>\n
37<\/div>\n
38<\/div>\n
39<\/div>\n
40<\/div>\n
41<\/div>\n
42<\/div>\n
43<\/div>\n
44<\/div>\n
45<\/div>\n
46<\/div>\n
47<\/div>\n<\/td>\n
\n
\n
[root@MySQL ~]<\/code># mysql -p'123'<\/code><\/div>\n
mysql: [Warning] Using a password on the <\/code>command<\/code> line interface can be insecure.<\/code><\/div>\n
 <\/div>\n
Welcome to the MySQL monitor.  Commands end with ; or \\g.<\/code><\/div>\n
Your MySQL connection <\/code>id<\/code> is 6<\/code><\/div>\n
Server version: 5.7.18 MySQL Community Server (GPL)<\/code><\/div>\n
 <\/div>\n
Copyright (c) 2000, 2017, Oracle and<\/code>\/or<\/code> its affiliates. All rights reserved.<\/code><\/div>\n
 <\/div>\n
Oracle is a registered trademark of Oracle Corporation and<\/code>\/or<\/code> its<\/code><\/div>\n
affiliates. Other names may be trademarks of their respective<\/code><\/div>\n
owners.<\/code><\/div>\n
 <\/div>\n
Type <\/code>'help;'<\/code> or <\/code>'\\h'<\/code> for<\/code> help. Type <\/code>'\\c'<\/code> to <\/code>clear<\/code> the current input statement.<\/code><\/div>\n
 <\/div>\n
mysql> <\/code>select<\/code> version();<\/code><\/div>\n
+-----------+<\/code><\/div>\n
| version() |<\/code><\/div>\n
+-----------+<\/code><\/div>\n
| 5.7.18    |<\/code><\/div>\n
+-----------+<\/code><\/div>\n
1 row <\/code>in<\/code> set<\/code> (0.00 sec)<\/code><\/div>\n
 <\/div>\n
mysql> show variables like <\/code>'have%ssl%'<\/code>;<\/code><\/div>\n
+---------------+----------+<\/code><\/div>\n
| Variable_name | Value    |<\/code><\/div>\n
+---------------+----------+<\/code><\/div>\n
| have_openssl  | DISABLED |<\/code><\/div>\n
| have_ssl      | DISABLED |<\/code><\/div>\n
+---------------+----------+<\/code><\/div>\n
2 rows <\/code>in<\/code> set<\/code> (0.02 sec)<\/code><\/div>\n
 <\/div>\n
mysql> show variables like <\/code>'port'<\/code>;<\/code><\/div>\n
+---------------+-------+<\/code><\/div>\n
| Variable_name | Value |<\/code><\/div>\n
+---------------+-------+<\/code><\/div>\n
| port          | 3306  |<\/code><\/div>\n
+---------------+-------+<\/code><\/div>\n
1 row <\/code>in<\/code> set<\/code> (0.01 sec)<\/code><\/div>\n
 <\/div>\n
mysql> show variables like <\/code>'datadir'<\/code>;<\/code><\/div>\n
+---------------+-------------------+<\/code><\/div>\n
| Variable_name | Value             |<\/code><\/div>\n
+---------------+-------------------+<\/code><\/div>\n
| datadir       | <\/code>\/data\/mysql_data\/<\/code> |<\/code><\/div>\n
+---------------+-------------------+<\/code><\/div>\n
1 row <\/code>in<\/code> set<\/code> (0.01 sec)<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n\n\n\n

5. SSL\u914d\u7f6e<\/strong><\/p>\n\n\n\n

*  \u5229\u7528\u81ea\u5e26\u5de5\u5177\u751f\u6210SSL\u76f8\u5173\u6587\u4ef6<\/p>\n\n\n\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n
15<\/div>\n
16<\/div>\n<\/td>\n
\n
\n
[root@MySQL ~]<\/code># \/usr\/local\/mysql\/bin\/mysql_ssl_rsa_setup --datadir=\/data\/mysql_data<\/code><\/div>\n
Generating a 2048 bit RSA private key<\/code><\/div>\n
..........................................................................+++<\/code><\/div>\n
.....+++<\/code><\/div>\n
writing new private key to <\/code>'ca-key.pem'<\/code><\/div>\n
-----<\/code><\/div>\n
Generating a 2048 bit RSA private key<\/code><\/div>\n
.......................................................................................................................................................................+++<\/code><\/div>\n
...+++<\/code><\/div>\n
writing new private key to <\/code>'server-key.pem'<\/code><\/div>\n
-----<\/code><\/div>\n
Generating a 2048 bit RSA private key<\/code><\/div>\n
.....................+++<\/code><\/div>\n
...........................................+++<\/code><\/div>\n
writing new private key to <\/code>'client-key.pem'<\/code><\/div>\n
-----<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n\n\n\n

* \u67e5\u770b\u751f\u6210\u7684SSL\u6587\u4ef6<\/p>\n\n\n\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n<\/td>\n
\n
\n
[root@MySQL ~]<\/code># ls -l \/data\/mysql_data\/*.pem<\/code><\/div>\n
-rw------- 1 root root 1679 Jun 24 20:54 <\/code>\/data\/mysql_data\/ca-key<\/code>.pem<\/code><\/div>\n
-rw-r--r-- 1 root root 1074 Jun 24 20:54 <\/code>\/data\/mysql_data\/ca<\/code>.pem<\/code><\/div>\n
-rw-r--r-- 1 root root 1078 Jun 24 20:54 <\/code>\/data\/mysql_data\/client-cert<\/code>.pem<\/code><\/div>\n
-rw------- 1 root root 1675 Jun 24 20:54 <\/code>\/data\/mysql_data\/client-key<\/code>.pem<\/code><\/div>\n
-rw------- 1 root root 1675 Jun 24 20:54 <\/code>\/data\/mysql_data\/private_key<\/code>.pem<\/code><\/div>\n
-rw-r--r-- 1 root root  451 Jun 24 20:54 <\/code>\/data\/mysql_data\/public_key<\/code>.pem<\/code><\/div>\n
-rw-r--r-- 1 root root 1078 Jun 24 20:54 <\/code>\/data\/mysql_data\/server-cert<\/code>.pem<\/code><\/div>\n
-rw------- 1 root root 1675 Jun 24 20:54 <\/code>\/data\/mysql_data\/server-key<\/code>.pem<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n\n\n\n

* \u4fee\u6539\u6570\u636e\u76ee\u5f55\u4e0b\u751f\u6210\u7684SSL\u6587\u4ef6\u6240\u5c5e\u7528\u6237\u4e0e\u6743\u9650<\/p>\n\n\n\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n<\/td>\n
\n
\n
[root@MySQL ~]<\/code># chown -v mysql.mysql \/data\/mysql_data\/*.pem<\/code><\/div>\n
changed ownership of `<\/code>\/data\/mysql_data\/ca-key<\/code>.pem' to mysql:mysql<\/code><\/div>\n
changed ownership of `<\/code>\/data\/mysql_data\/ca<\/code>.pem' to mysql:mysql<\/code><\/div>\n
changed ownership of `<\/code>\/data\/mysql_data\/client-cert<\/code>.pem' to mysql:mysql<\/code><\/div>\n
changed ownership of `<\/code>\/data\/mysql_data\/client-key<\/code>.pem' to mysql:mysql<\/code><\/div>\n
changed ownership of `<\/code>\/data\/mysql_data\/private_key<\/code>.pem' to mysql:mysql<\/code><\/div>\n
changed ownership of `<\/code>\/data\/mysql_data\/public_key<\/code>.pem' to mysql:mysql<\/code><\/div>\n
changed ownership of `<\/code>\/data\/mysql_data\/server-cert<\/code>.pem' to mysql:mysql<\/code><\/div>\n
changed ownership of `<\/code>\/data\/mysql_data\/server-key<\/code>.pem' to mysql:mysql<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n\n\n\n

* \u67e5\u770b\u751f\u6210\u7684SSL\u6587\u4ef6<\/p>\n\n\n\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n<\/td>\n
\n
\n
[root@MySQL ~]<\/code># ls -l \/data\/mysql_data\/*.pem<\/code><\/div>\n
-rw------- 1 mysql mysql 1679 Jun 24 20:54 <\/code>\/data\/mysql_data\/ca-key<\/code>.pem<\/code><\/div>\n
-rw-r--r-- 1 mysql mysql 1074 Jun 24 20:54 <\/code>\/data\/mysql_data\/ca<\/code>.pem<\/code><\/div>\n
-rw-r--r-- 1 mysql mysql 1078 Jun 24 20:54 <\/code>\/data\/mysql_data\/client-cert<\/code>.pem<\/code><\/div>\n
-rw------- 1 mysql mysql 1675 Jun 24 20:54 <\/code>\/data\/mysql_data\/client-key<\/code>.pem<\/code><\/div>\n
-rw------- 1 mysql mysql 1675 Jun 24 20:54 <\/code>\/data\/mysql_data\/private_key<\/code>.pem<\/code><\/div>\n
-rw-r--r-- 1 mysql mysql  451 Jun 24 20:54 <\/code>\/data\/mysql_data\/public_key<\/code>.pem<\/code><\/div>\n
-rw-r--r-- 1 mysql mysql 1078 Jun 24 20:54 <\/code>\/data\/mysql_data\/server-cert<\/code>.pem<\/code><\/div>\n
-rw------- 1 mysql mysql 1675 Jun 24 20:54 <\/code>\/data\/mysql_data\/server-key<\/code>.pem<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n\n\n\n

* \u91cd\u542f MySQL \u670d\u52a1<\/p>\n\n\n\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n<\/td>\n
\n
\n
[root@MySQL ~]<\/code># \/etc\/init.d\/mysqld restart<\/code><\/div>\n
Shutting down MySQL.. SUCCESS! <\/code><\/div>\n
Starting MySQL. SUCCESS!<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n\n\n\n

* \u8fde\u63a5MySQL \u67e5\u770bSSL\u5f00\u542f\u72b6\u6001<\/p>\n\n\n\n

have_openssl \u4e0e have_ssl \u503c\u90fd\u4e3aYES\u8868\u793assl\u5f00\u542f\u6210\u529f<\/strong><\/p>\n\n\n\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n<\/td>\n
\n
\n
mysql> show variables like <\/code>'have%ssl%'<\/code>;<\/code><\/div>\n
+---------------+-------+<\/code><\/div>\n
| Variable_name | Value |<\/code><\/div>\n
+---------------+-------+<\/code><\/div>\n
| have_openssl  | YES   |<\/code><\/div>\n
| have_ssl      | YES   |<\/code><\/div>\n
+---------------+-------+<\/code><\/div>\n
2 rows <\/code>in<\/code> set<\/code> (0.03 sec)<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n\n\n\n

6. SSL + \u5bc6\u7801\u8fde\u63a5\u6d4b\u8bd5<\/strong><\/strong><\/p>\n\n\n\n

* \u521b\u5efa\u7528\u6237\u5e76\u6307\u5b9a SSL \u8fde\u63a5 [ MySQL 5.7\u540e\u63a8\u8350\u4f7f\u7528create user \u65b9\u5f0f\u521b\u5efa\u7528\u6237<\/strong> ]<\/p>\n\n\n\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n<\/td>\n
\n
\n
mysql> create user <\/code>'ssl_test'<\/code>@<\/code>'%'<\/code> identified by <\/code>'123'<\/code> require SSL;<\/code><\/div>\n
Query OK, 0 rows affected (0.00 sec)<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n\n\n\n

* \u901a\u8fc7\u5bc6\u7801\u8fde\u63a5\u6d4b\u8bd5 [ \u9ed8\u8ba4\u91c7\u7528SSL\u8fde\u63a5\uff0c\u9700\u8981\u6307\u5b9a\u4e0d\u4f7f\u7528SSL\u8fde\u63a5<\/strong> ]<\/p>\n\n\n\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n<\/td>\n
\n
\n
[root@MySQL ~]<\/code># mysql -h 192.168.60.129 -ussl_test -p'123' --ssl=0<\/code><\/div>\n
mysql: [Warning] Using a password on the <\/code>command<\/code> line interface can be insecure.<\/code><\/div>\n
ERROR 1045 (28000): Access denied <\/code>for<\/code> user <\/code>'ssl_test'<\/code>@<\/code>'192.168.60.129'<\/code> (using password: YES)<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n\n\n\n

* \u901a\u8fc7 SSL + \u5bc6\u7801 \u8fde\u63a5\u6d4b\u8bd5<\/p>\n\n\n\n

SSL: Cipher in use is DHE-RSA-AES256-SHA \u8868\u793a\u901a\u8fc7SSL\u8fde\u63a5<\/p>\n\n\n\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n
15<\/div>\n
16<\/div>\n
17<\/div>\n
18<\/div>\n
19<\/div>\n
20<\/div>\n
21<\/div>\n
22<\/div>\n
23<\/div>\n
24<\/div>\n
25<\/div>\n
26<\/div>\n
27<\/div>\n
28<\/div>\n
29<\/div>\n
30<\/div>\n
31<\/div>\n
32<\/div>\n
33<\/div>\n
34<\/div>\n
35<\/div>\n
36<\/div>\n
37<\/div>\n
38<\/div>\n<\/td>\n
\n
\n
[root@MySQL ~]<\/code># mysql -h 192.168.60.129 -ussl_test -p'123'  --ssl<\/code><\/div>\n
mysql: [Warning] Using a password on the <\/code>command<\/code> line interface can be insecure.<\/code><\/div>\n
WARNING: --ssl is deprecated and will be removed <\/code>in<\/code> a future version. Use --ssl-mode instead.<\/code><\/div>\n
Welcome to the MySQL monitor.  Commands end with ; or \\g.<\/code><\/div>\n
Your MySQL connection <\/code>id<\/code> is 12<\/code><\/div>\n
Server version: 5.7.18 MySQL Community Server (GPL)<\/code><\/div>\n
 <\/div>\n
Copyright (c) 2000, 2017, Oracle and<\/code>\/or<\/code> its affiliates. All rights reserved.<\/code><\/div>\n
 <\/div>\n
Oracle is a registered trademark of Oracle Corporation and<\/code>\/or<\/code> its<\/code><\/div>\n
affiliates. Other names may be trademarks of their respective<\/code><\/div>\n
owners.<\/code><\/div>\n
 <\/div>\n
Type <\/code>'help;'<\/code> or <\/code>'\\h'<\/code> for<\/code> help. Type <\/code>'\\c'<\/code> to <\/code>clear<\/code> the current input statement.<\/code><\/div>\n
 <\/div>\n
mysql> \\s<\/code><\/div>\n
--------------<\/code><\/div>\n
mysql  Ver 14.14 Distrib 5.7.18, <\/code>for<\/code> linux-glibc2.5 (x86_64) using  EditLine wrapper<\/code><\/div>\n
 <\/div>\n
Connection <\/code>id<\/code>:     12<\/code><\/div>\n
Current database:  <\/code><\/div>\n
Current user:      ssl_test@192.168.60.129<\/code><\/div>\n
SSL:            Cipher <\/code>in<\/code> use is DHE-RSA-AES256-SHA<\/code><\/div>\n
Current pager:     stdout<\/code><\/div>\n
Using outfile:     <\/code>''<\/code><\/div>\n
Using delimiter:   ;<\/code><\/div>\n
Server version:        5.7.18 MySQL Community Server (GPL)<\/code><\/div>\n
Protocol version:  10<\/code><\/div>\n
Connection:     192.168.60.129 via TCP<\/code>\/IP<\/code><\/div>\n
Server characterset:   latin1<\/code><\/div>\n
Db     characterset:   latin1<\/code><\/div>\n
Client characterset:   utf8<\/code><\/div>\n
Conn.  characterset:  utf8<\/code><\/div>\n
TCP port:      3306<\/code><\/div>\n
Uptime:         7 min 34 sec<\/code><\/div>\n
 <\/div>\n
Threads: 1  Questions: 29  Slow queries: 0  Opens: 112  Flush tables: 1  Open tables: 105  Queries per second avg: 0.063<\/code><\/div>\n
--------------<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n\n\n\n

7. SSL + \u5bc6\u7801 + \u5bc6\u94a5\u8fde\u63a5<\/strong><\/p>\n\n\n\n

* \u521b\u5efa\u7528\u6237\u5e76\u6307\u5b9a X509 [ SSL+\u5bc6\u94a5 ] \u8fde\u63a5 [ MySQL 5.7\u540e\u63a8\u8350\u4f7f\u7528create user \u65b9\u5f0f\u521b\u5efa\u7528\u6237<\/strong> ]<\/p>\n\n\n\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n<\/td>\n
\n
\n
mysql> create user <\/code>'X509_test'<\/code>@<\/code>'%'<\/code> identified by <\/code>'123'<\/code> require X509;<\/code><\/div>\n
Query OK, 0 rows affected (0.00 sec)<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n\n\n\n

* \u901a\u8fc7\u5bc6\u7801\u8fde\u63a5\u6d4b\u8bd5<\/p>\n\n\n\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n<\/td>\n
\n
\n
[root@MySQL ~]<\/code># mysql -h 192.168.60.129 -uX509_test -p'123' --ssl=0<\/code><\/div>\n
mysql: [Warning] Using a password on the <\/code>command<\/code> line interface can be insecure.<\/code><\/div>\n
ERROR 1045 (28000): Access denied <\/code>for<\/code> user <\/code>'X509_test'<\/code>@<\/code>'192.168.60.129'<\/code> (using password: YES)<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n\n\n\n

* \u901a\u8fc7 SSL +\u5bc6\u7801 \u8fde\u63a5\u6d4b\u8bd5<\/p>\n\n\n\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n<\/td>\n
\n
\n
[root@MySQL ~]<\/code># mysql -h 192.168.60.129 -uX509_test -p'123' --ssl<\/code><\/div>\n
mysql: [Warning] Using a password on the <\/code>command<\/code> line interface can be insecure.<\/code><\/div>\n
ERROR 1045 (28000): Access denied <\/code>for<\/code> user <\/code>'X509_test'<\/code>@<\/code>'192.168.60.129'<\/code> (using password: YES)<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n\n\n\n

* \u901a\u8fc7 SSL + \u5bc6\u7801\uff0b\u5bc6\u94a5\u8fde\u63a5\u6d4b\u8bd5<\/p>\n\n\n\n

SSL: Cipher in use is DHE-RSA-AES256-SHA \u8868\u793a\u901a\u8fc7SSL\u8fde\u63a5<\/p>\n\n\n\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n
15<\/div>\n
16<\/div>\n
17<\/div>\n
18<\/div>\n
19<\/div>\n
20<\/div>\n
21<\/div>\n
22<\/div>\n
23<\/div>\n
24<\/div>\n
25<\/div>\n
26<\/div>\n
27<\/div>\n
28<\/div>\n
29<\/div>\n
30<\/div>\n
31<\/div>\n
32<\/div>\n
33<\/div>\n
34<\/div>\n
35<\/div>\n
36<\/div>\n
37<\/div>\n<\/td>\n
\n
\n
[root@MySQL ~]<\/code># mysql -h 192.168.60.129 -uX509_test -p'123' --ssl-cert=\/data\/mysql_data\/client-cert.pem --ssl-key=\/data\/mysql_data\/client-key.pem <\/code><\/div>\n
mysql: [Warning] Using a password on the <\/code>command<\/code> line interface can be insecure.<\/code><\/div>\n
Welcome to the MySQL monitor.  Commands end with ; or \\g.<\/code><\/div>\n
Your MySQL connection <\/code>id<\/code> is 21<\/code><\/div>\n
Server version: 5.7.18 MySQL Community Server (GPL)<\/code><\/div>\n
 <\/div>\n
Copyright (c) 2000, 2017, Oracle and<\/code>\/or<\/code> its affiliates. All rights reserved.<\/code><\/div>\n
 <\/div>\n
Oracle is a registered trademark of Oracle Corporation and<\/code>\/or<\/code> its<\/code><\/div>\n
affiliates. Other names may be trademarks of their respective<\/code><\/div>\n
owners.<\/code><\/div>\n
 <\/div>\n
Type <\/code>'help;'<\/code> or <\/code>'\\h'<\/code> for<\/code> help. Type <\/code>'\\c'<\/code> to <\/code>clear<\/code> the current input statement.<\/code><\/div>\n
 <\/div>\n
mysql> \\s<\/code><\/div>\n
--------------<\/code><\/div>\n
mysql  Ver 14.14 Distrib 5.7.18, <\/code>for<\/code> linux-glibc2.5 (x86_64) using  EditLine wrapper<\/code><\/div>\n
 <\/div>\n
Connection <\/code>id<\/code>:     21<\/code><\/div>\n
Current database:  <\/code><\/div>\n
Current user:      X509_test@192.168.60.129<\/code><\/div>\n
SSL:            Cipher <\/code>in<\/code> use is DHE-RSA-AES256-SHA<\/code><\/div>\n
Current pager:     stdout<\/code><\/div>\n
Using outfile:     <\/code>''<\/code><\/div>\n
Using delimiter:   ;<\/code><\/div>\n
Server version:        5.7.18 MySQL Community Server (GPL)<\/code><\/div>\n
Protocol version:  10<\/code><\/div>\n
Connection:     192.168.60.129 via TCP<\/code>\/IP<\/code><\/div>\n
Server characterset:   latin1<\/code><\/div>\n
Db     characterset:   latin1<\/code><\/div>\n
Client characterset:   utf8<\/code><\/div>\n
Conn.  characterset:  utf8<\/code><\/div>\n
TCP port:      3306<\/code><\/div>\n
Uptime:         18 min 27 sec<\/code><\/div>\n
 <\/div>\n
Threads: 1  Questions: 40  Slow queries: 0  Opens: 118  Flush tables: 1  Open tables: 111  Queries per second avg: 0.036<\/code><\/div>\n
--------------<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

1. \u80cc\u666f * \u5728\u751f\u4ea7\u73af\u5883\u4e0b\uff0c\u5b89\u5168\u603b\u662f\u65e0\u6cd5\u5ffd\u89c6\u7684\u95ee\u9898\uff0c\u6570\u636e\u5e93\u5b89\u5168\u5219\u662f\u91cd\u4e2d\u4e4b\u91cd\uff0c\u56e0\u4e3a\u6240\u6709\u7684\u6570\u636e\u90fd\u5b58\u653e\u5728 … \u9605\u8bfb\u66f4\u591a<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[10],"tags":[45,176],"class_list":["post-2411","post","type-post","status-publish","format-standard","hentry","category-shujuku","tag-mysql","tag-ssl"],"aioseo_notices":[],"jetpack_featured_media_url":"","jetpack-related-posts":[],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/cn.hostease.com\/xueyuan\/wp-json\/wp\/v2\/posts\/2411","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cn.hostease.com\/xueyuan\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cn.hostease.com\/xueyuan\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cn.hostease.com\/xueyuan\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cn.hostease.com\/xueyuan\/wp-json\/wp\/v2\/comments?post=2411"}],"version-history":[{"count":2,"href":"https:\/\/cn.hostease.com\/xueyuan\/wp-json\/wp\/v2\/posts\/2411\/revisions"}],"predecessor-version":[{"id":9529,"href":"https:\/\/cn.hostease.com\/xueyuan\/wp-json\/wp\/v2\/posts\/2411\/revisions\/9529"}],"wp:attachment":[{"href":"https:\/\/cn.hostease.com\/xueyuan\/wp-json\/wp\/v2\/media?parent=2411"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cn.hostease.com\/xueyuan\/wp-json\/wp\/v2\/categories?post=2411"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cn.hostease.com\/xueyuan\/wp-json\/wp\/v2\/tags?post=2411"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}