Commit bf10717a authored by unknown's avatar unknown

OpenSSL fixes


SSL/NOTES:
  Comments added
parent 3e899543
Quick notes: Quick notes:
--------------------------------------------
[tonu@x153 mysql-4.0]$ cat /etc/my.cnf
[mysqld]
ssl-ca=SSL/cacert.pem
ssl-cert=SSL/server-cert.pem
ssl-key=SSL/server-key.pem
[mysql]
ssl-ca=SSL/cacert.pem
ssl-cert=SSL/client-cert.pem
ssl-key=SSL/client-key.pem
[mysqldump]
ssl-ca=SSL/cacert.pem
ssl-cert=SSL/client-cert.pem
ssl-key=SSL/client-key.pem
[tonu@x153 mysql-4.0]$
--------------------------------------------
To remove passwords from keyfiles: To remove passwords from keyfiles:
[tonu@x153 SSL]$ openssl rsa -inform pem < server-req.pem > server-key.pem [tonu@x153 SSL]$ openssl rsa -inform pem < server-req.pem > server-key.pem
read RSA key read RSA key
Enter PEM pass phrase: Enter PEM pass phrase:
...@@ -12,12 +28,10 @@ writing RSA key ...@@ -12,12 +28,10 @@ writing RSA key
To run server: To run server:
sql/mysqld --ssl-ca=SSL/cacert.pem --ssl-cert=SSL/server-cert.pem --ssl-key=SSL/server-key.pem --skip-grant --debug='d:t:O,-' > /tmp/mysqld.trace sql/mysqld --ssl-ca=SSL/cacert.pem --ssl-cert=SSL/server-cert.pem --ssl-key=SSL/server-key.pem --skip-grant --debug='d:t:O,-' > /tmp/mysqld.trace
-------------------------------------------- --------------------------------------------
To run client: To run client:
client/mysql --ssl-ca=SSL/cacert.pem --ssl-cert=SSL/server-cert.pem --ssl-key=SSL/server-key.pem --debug='d:t:O,/tmp/client.trace' -h 127.0.0.1 client/mysql --ssl-ca=SSL/cacert.pem --ssl-cert=SSL/server-cert.pem --ssl-key=SSL/server-key.pem --debug='d:t:O,/tmp/client.trace' -h 127.0.0.1
-------------------------------------------- --------------------------------------------
openssl s_client -host 127.0.0.1 -port 1111 -debug -verify 1 -cert ../SSL/client-cert.pem -key ../SSL/client-key.pem -CAfile ../SSL/cacert.pem -pause -showcerts -state openssl s_client -host 127.0.0.1 -port 1111 -debug -verify 1 -cert ../SSL/client-cert.pem -key ../SSL/client-key.pem -CAfile ../SSL/cacert.pem -pause -showcerts -state
...@@ -27,8 +41,9 @@ openssl s_server -port 1111 -cert ../SSL/server-cert.pem -key ../SSL/server-key. ...@@ -27,8 +41,9 @@ openssl s_server -port 1111 -cert ../SSL/server-cert.pem -key ../SSL/server-key.
--------------------------------------------
CA stuff:
[tonu@x153 bin]$ pwd [tonu@x153 bin]$ pwd
/usr/local/ssl/bin /usr/local/ssl/bin
......
-- require r/have_ssl.require -- require r/have_openssl.require
show variables like "have_ssl"; show variables like "have_openssl";
-- source include/have_openssl.inc
# We want to test everything with SSL turned on. # We want to test everything with SSL turned on.
-- source include/have_openssl.inc
SHOW STATUS LIKE 'SSL%'; SHOW STATUS LIKE 'SSL%';
...@@ -202,9 +202,9 @@ SHOW_COMP_OPTION have_raid=SHOW_OPTION_YES; ...@@ -202,9 +202,9 @@ SHOW_COMP_OPTION have_raid=SHOW_OPTION_YES;
SHOW_COMP_OPTION have_raid=SHOW_OPTION_NO; SHOW_COMP_OPTION have_raid=SHOW_OPTION_NO;
#endif #endif
#ifdef HAVE_OPENSSL #ifdef HAVE_OPENSSL
SHOW_COMP_OPTION have_ssl=SHOW_OPTION_YES; SHOW_COMP_OPTION have_openssl=SHOW_OPTION_YES;
#else #else
SHOW_COMP_OPTION have_ssl=SHOW_OPTION_NO; SHOW_COMP_OPTION have_openssl=SHOW_OPTION_NO;
#endif #endif
SHOW_COMP_OPTION have_symlink=SHOW_OPTION_YES; SHOW_COMP_OPTION have_symlink=SHOW_OPTION_YES;
...@@ -2894,7 +2894,7 @@ struct show_var_st init_vars[]= { ...@@ -2894,7 +2894,7 @@ struct show_var_st init_vars[]= {
{"have_isam", (char*) &have_isam, SHOW_HAVE}, {"have_isam", (char*) &have_isam, SHOW_HAVE},
{"have_raid", (char*) &have_raid, SHOW_HAVE}, {"have_raid", (char*) &have_raid, SHOW_HAVE},
{"have_symlink", (char*) &have_symlink, SHOW_HAVE}, {"have_symlink", (char*) &have_symlink, SHOW_HAVE},
{"have_ssl", (char*) &have_ssl, SHOW_HAVE}, {"have_openssl", (char*) &have_openssl, SHOW_HAVE},
{"init_file", (char*) &opt_init_file, SHOW_CHAR_PTR}, {"init_file", (char*) &opt_init_file, SHOW_CHAR_PTR},
#ifdef HAVE_INNOBASE_DB #ifdef HAVE_INNOBASE_DB
{"innodb_data_file_path", (char*) &innobase_data_file_path, SHOW_CHAR_PTR}, {"innodb_data_file_path", (char*) &innobase_data_file_path, SHOW_CHAR_PTR},
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment