To use SSL for encrypting the transfer of the binary log required during replication, both the master and the slave must support SSL network connections. If either host does not support SSL connections (because it has not been compiled or configured for SSL), replication through an SSL connection is not possible.
Setting up replication using an SSL connection is similar to setting up a server and client using SSL. You must obtain (or create) a suitable security certificate that you can use on the master, and a similar certificate (from the same certificate authority) on each slave.
For more information on setting up a server and client for SSL connectivity, see Section 5.5.6.2, “Using SSL Connections”.
To enable SSL on the master you must create or obtain suitable
certificates, and then add the following configuration options to
the master's configuration within the [mysqld]
section of the master's my.cnf
file:
[mysqld] ssl-ca=cacert.pem
ssl-cert=server-cert.pem
ssl-key=server-key.pem
The paths to the certificates may be relative or absolute; we recommend that you always use complete paths for this purpose.
The options are as follows:
ssl-ca
identifies the Certificate Authority
(CA) certificate.
ssl-cert
identifies the server public key.
This can be sent to the client and authenticated against the
CA certificate that it has.
ssl-key
identifies the server private key.
On the slave, you have two options available for setting the SSL
information. You can either add the slave certificates to the
[client]
section of the slave's
my.cnf
file, or you can explicitly specify
the SSL information using the CHANGE MASTER
TO
statement:
To add the slave certificates using an option file, add the
following lines to the [client]
section of
the slave's my.cnf
file:
[client] ssl-ca=cacert.pem
ssl-cert=client-cert.pem
ssl-key=client-key.pem
Restart the slave server, using the
--skip-slave-start
option to
prevent the slave from connecting to the master. Use
CHANGE MASTER TO
to specify the
master configuration, using the MASTER_SSL
option to enable SSL connectivity:
mysql>CHANGE MASTER TO
->MASTER_HOST='master_hostname',
->MASTER_USER='replicate',
->MASTER_PASSWORD='password',
->MASTER_SSL=1;
To specify the SSL certificate options using the
CHANGE MASTER TO
statement,
append the SSL options:
mysql>CHANGE MASTER TO
->MASTER_HOST='master_hostname',
->MASTER_USER='replicate',
->MASTER_PASSWORD='password',
->MASTER_SSL=1,
->MASTER_SSL_CA = 'ca_file_name',
->MASTER_SSL_CAPATH = 'ca_directory_name',
->MASTER_SSL_CERT = 'cert_file_name',
->MASTER_SSL_KEY = 'key_file_name';
After the master information has been updated, start the slave replication process:
mysql> START SLAVE;
You can use the SHOW SLAVE STATUS
statement to confirm that the SSL connection was established
successfully.
For more information on the CHANGE MASTER
TO
statement, see Section 12.5.2.1, “CHANGE MASTER TO
Syntax”.
If you want to enforce the use of SSL connections during
replication, then create a user with the
REPLICATION SLAVE
privilege and use
the REQUIRE SSL
option for that user. For
example:
mysql>CREATE USER 'repl'@'%.mydomain.com' IDENTIFIED BY 'slavepass';
mysql>GRANT REPLICATION SLAVE ON *.*
->TO 'repl'@'%.mydomain.com' REQUIRE SSL;
If the account already exists, you can add REQUIRE
SSL
to it with this statement:
mysql>GRANT USAGE ON *.*
->TO 'repl'@'%.mydomain.com' REQUIRE SSL;
User Comments
Add your own comment.