6.3.3.2 使用 openssl 创建 SSL 证书和密钥

本节介绍如何使用 openssl 命令设置 SSL 证书和密钥文件,以供 MySQL 服务器和 Client 端使用。第一个示例显示了一个简化的过程,例如您可以在命令行中使用的过程。第二个脚本显示了包含更多细节的脚本。前两个示例旨在在 Unix 上使用,并且都使用 OpenSSL 中的 openssl 命令。第三个示例描述了如何在 Windows 上设置 SSL 文件。

Note

生成 SSL 所需文件的替代方法比此处描述的过程更简单:让服务器自动生成文件或使用mysql_ssl_rsa_setup程序。参见第 6.3.3.1 节“使用 MySQL 创建 SSL 和 RSA 证书和密钥”

Important

无论使用哪种方法生成证书和密钥文件,用于服务器和 Client 端证书/密钥的“公用名”值都必须与用于 CA 证书的“公用名”值不同。否则,证书和密钥文件将不适用于使用 OpenSSL 编译的服务器。这种情况下的典型错误是:

ERROR 2026 (HY000): SSL connection error:
error:00000001:lib(0):func(0):reason(1)
示例 1:在 Unix 上从命令行创建 SSL 文件

以下示例显示了一组用于创建 MySQL 服务器和 Client 端证书以及密钥文件的命令。您将需要通过 openssl 命令来响应多个提示。要生成测试文件,可以按 Enter 键进入所有提示。要生成供生产使用的文件,应提供非空响应。

# Create clean environment
rm -rf newcerts
mkdir newcerts && cd newcerts

# Create CA certificate
openssl genrsa 2048 > ca-key.pem
openssl req -new -x509 -nodes -days 3600 \
        -key ca-key.pem -out ca.pem

# Create server certificate, remove passphrase, and sign it
# server-cert.pem = public key, server-key.pem = private key
openssl req -newkey rsa:2048 -days 3600 \
        -nodes -keyout server-key.pem -out server-req.pem
openssl rsa -in server-key.pem -out server-key.pem
openssl x509 -req -in server-req.pem -days 3600 \
        -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem

# Create client certificate, remove passphrase, and sign it
# client-cert.pem = public key, client-key.pem = private key
openssl req -newkey rsa:2048 -days 3600 \
        -nodes -keyout client-key.pem -out client-req.pem
openssl rsa -in client-key.pem -out client-key.pem
openssl x509 -req -in client-req.pem -days 3600 \
        -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out client-cert.pem

生成证书后,请验证它们:

openssl verify -CAfile ca.pem server-cert.pem client-cert.pem

您应该看到这样的响应:

server-cert.pem: OK
client-cert.pem: OK

要查看证书的内容(例如,检查证书有效的日期范围),请像下面这样调用 openssl

openssl x509 -text -in ca.pem
openssl x509 -text -in server-cert.pem
openssl x509 -text -in client-cert.pem

现在,您可以使用一组文件,如下所示:

  • ca.pem:使用它来设置服务器端的ssl_ca系统变量和 Client 端端的--ssl-ca选项。 (如果使用了 CA 证书,则双方必须相同.)

  • server-cert.pemserver-key.pem:使用它们来设置服务器端的ssl_certssl_key系统变量。

  • client-cert.pemclient-key.pem:将它们用作 Client 端上--ssl-cert--ssl-key选项的参数。

有关其他使用说明,请参见第 6.3.1 节“配置 MySQL 以使用加密连接”

示例 2:在 Unix 上使用脚本创建 SSL 文件

这是一个示例脚本,显示了如何为 MySQL 设置 SSL 证书和密钥文件。执行脚本后,按照第 6.3.1 节“配置 MySQL 以使用加密连接”所述使用文件进行 SSL 连接。

DIR=`pwd`/openssl
PRIV=$DIR/private

mkdir $DIR $PRIV $DIR/newcerts
cp /usr/share/ssl/openssl.cnf $DIR
replace ./demoCA $DIR -- $DIR/openssl.cnf

# Create necessary files: $database, $serial and $new_certs_dir
# directory (optional)

touch $DIR/index.txt
echo "01" > $DIR/serial

#
# Generation of Certificate Authority(CA)
#

openssl req -new -x509 -keyout $PRIV/cakey.pem -out $DIR/ca.pem \
    -days 3600 -config $DIR/openssl.cnf

# Sample output:
# Using configuration from /home/finley/openssl/openssl.cnf
# Generating a 1024 bit RSA private key
# ................++++++
# .........++++++
# writing new private key to '/home/finley/openssl/private/cakey.pem'
# Enter PEM pass phrase:
# Verifying password - Enter PEM pass phrase:
# -----
# You are about to be asked to enter information that will be
# incorporated into your certificate request.
# What you are about to enter is what is called a Distinguished Name
# or a DN.
# There are quite a few fields but you can leave some blank
# For some fields there will be a default value,
# If you enter '.', the field will be left blank.
# -----
# Country Name (2 letter code) [AU]:FI
# State or Province Name (full name) [Some-State]:.
# Locality Name (eg, city) []:
# Organization Name (eg, company) [Internet Widgits Pty Ltd]:MySQL AB
# Organizational Unit Name (eg, section) []:
# Common Name (eg, YOUR name) []:MySQL admin
# Email Address []:

#
# Create server request and key
#
openssl req -new -keyout $DIR/server-key.pem -out \
    $DIR/server-req.pem -days 3600 -config $DIR/openssl.cnf

# Sample output:
# Using configuration from /home/finley/openssl/openssl.cnf
# Generating a 1024 bit RSA private key
# ..++++++
# ..........++++++
# writing new private key to '/home/finley/openssl/server-key.pem'
# Enter PEM pass phrase:
# Verifying password - Enter PEM pass phrase:
# -----
# You are about to be asked to enter information that will be
# incorporated into your certificate request.
# What you are about to enter is what is called a Distinguished Name
# or a DN.
# There are quite a few fields but you can leave some blank
# For some fields there will be a default value,
# If you enter '.', the field will be left blank.
# -----
# Country Name (2 letter code) [AU]:FI
# State or Province Name (full name) [Some-State]:.
# Locality Name (eg, city) []:
# Organization Name (eg, company) [Internet Widgits Pty Ltd]:MySQL AB
# Organizational Unit Name (eg, section) []:
# Common Name (eg, YOUR name) []:MySQL server
# Email Address []:
#
# Please enter the following 'extra' attributes
# to be sent with your certificate request
# A challenge password []:
# An optional company name []:

#
# Remove the passphrase from the key
#
openssl rsa -in $DIR/server-key.pem -out $DIR/server-key.pem

#
# Sign server cert
#
openssl ca -cert $DIR/ca.pem -policy policy_anything \
    -out $DIR/server-cert.pem -config $DIR/openssl.cnf \
    -infiles $DIR/server-req.pem

# Sample output:
# Using configuration from /home/finley/openssl/openssl.cnf
# Enter PEM pass phrase:
# Check that the request matches the signature
# Signature ok
# The Subjects Distinguished Name is as follows
# countryName           :PRINTABLE:'FI'
# organizationName      :PRINTABLE:'MySQL AB'
# commonName            :PRINTABLE:'MySQL admin'
# Certificate is to be certified until Sep 13 14:22:46 2003 GMT
# (365 days)
# Sign the certificate? [y/n]:y
#
#
# 1 out of 1 certificate requests certified, commit? [y/n]y
# Write out database with 1 new entries
# Data Base Updated

#
# Create client request and key
#
openssl req -new -keyout $DIR/client-key.pem -out \
    $DIR/client-req.pem -days 3600 -config $DIR/openssl.cnf

# Sample output:
# Using configuration from /home/finley/openssl/openssl.cnf
# Generating a 1024 bit RSA private key
# .....................................++++++
# .............................................++++++
# writing new private key to '/home/finley/openssl/client-key.pem'
# Enter PEM pass phrase:
# Verifying password - Enter PEM pass phrase:
# -----
# You are about to be asked to enter information that will be
# incorporated into your certificate request.
# What you are about to enter is what is called a Distinguished Name
# or a DN.
# There are quite a few fields but you can leave some blank
# For some fields there will be a default value,
# If you enter '.', the field will be left blank.
# -----
# Country Name (2 letter code) [AU]:FI
# State or Province Name (full name) [Some-State]:.
# Locality Name (eg, city) []:
# Organization Name (eg, company) [Internet Widgits Pty Ltd]:MySQL AB
# Organizational Unit Name (eg, section) []:
# Common Name (eg, YOUR name) []:MySQL user
# Email Address []:
#
# Please enter the following 'extra' attributes
# to be sent with your certificate request
# A challenge password []:
# An optional company name []:

#
# Remove the passphrase from the key
#
openssl rsa -in $DIR/client-key.pem -out $DIR/client-key.pem

#
# Sign client cert
#

openssl ca -cert $DIR/ca.pem -policy policy_anything \
    -out $DIR/client-cert.pem -config $DIR/openssl.cnf \
    -infiles $DIR/client-req.pem

# Sample output:
# Using configuration from /home/finley/openssl/openssl.cnf
# Enter PEM pass phrase:
# Check that the request matches the signature
# Signature ok
# The Subjects Distinguished Name is as follows
# countryName           :PRINTABLE:'FI'
# organizationName      :PRINTABLE:'MySQL AB'
# commonName            :PRINTABLE:'MySQL user'
# Certificate is to be certified until Sep 13 16:45:17 2003 GMT
# (365 days)
# Sign the certificate? [y/n]:y
#
#
# 1 out of 1 certificate requests certified, commit? [y/n]y
# Write out database with 1 new entries
# Data Base Updated

#
# Create a my.cnf file that you can use to test the certificates
#

cat <<EOF > $DIR/my.cnf
[client]
ssl-ca=$DIR/ca.pem
ssl-cert=$DIR/client-cert.pem
ssl-key=$DIR/client-key.pem
[mysqld]
ssl_ca=$DIR/ca.pem
ssl_cert=$DIR/server-cert.pem
ssl_key=$DIR/server-key.pem
EOF
示例 3:在 Windows 上创建 SSL 文件

如果您的系统上未安装 OpenSSL for Windows,请下载。可在此处查看可用软件包的概述:

http://www.slproweb.com/products/Win32OpenSSL.html

选择 Win32 OpenSSL Light 或 Win64 OpenSSL Light 软件包,具体取决于您的体系结构(32 位或 64 位)。默认安装位置为C:\OpenSSL-Win32C:\OpenSSL-Win64,具体取决于您下载的软件包。以下说明假定默认位置为C:\OpenSSL-Win32。如果使用的是 64 位软件包,请根据需要进行修改。

如果在安装过程中出现指示'...critical component is missing: Microsoft Visual C++ 2008 Redistributables'的消息,请再次取消安装并下载以下软件包之一,具体取决于您的体系结构(32 位还是 64 位):

  • Visual C 2008 可再发行组件(x86),位于:
http://www.microsoft.com/downloads/details.aspx?familyid=9B2DA534-3E03-4391-8A4D-074B9F2BC1BF
  • Visual C 2008 可再发行组件(x64),位于:
http://www.microsoft.com/downloads/details.aspx?familyid=bd2a6171-e2d6-4230-b809-9a8d7548c1b6

安装其他软件包后,请重新启动 OpenSSL 设置过程。

在安装过程中,保留默认的C:\OpenSSL-Win32作为安装路径,并保留选中的默认选项'Copy OpenSSL DLL files to the Windows system directory'

安装完成后,将C:\OpenSSL-Win32\bin添加到服务器的 Windows 系统路径变量(根据 Windows 版本的不同,以下路径设置说明可能会略有不同):

  • 在 Windows 桌面上,右键单击“我的电脑”图标,然后选择“属性”。

  • 从出现的“系统属性”菜单中选择“高级”选项卡,然后单击“环境变量”按钮。

  • 在系统变量下,选择路径,然后单击编辑按钮。将出现“编辑系统变量”对话框。

  • 最后添加';C:\OpenSSL-Win32\bin'(注意分号)。

  • 按 OK 3 次。

  • 通过打开新的命令控制台( Start> Run> cmd.exe )并验证 OpenSSL 是否可用,来检查 OpenSSL 是否已正确集成到 Path 变量中:

Microsoft Windows [Version ...]
Copyright (c) 2006 Microsoft Corporation. All rights reserved.

C:\Windows\system32>cd \

C:\>openssl
OpenSSL> exit <<< If you see the OpenSSL prompt, installation was successful.

C:\>

安装 OpenSSL 之后,使用与示例 1(本节前面所示)类似的说明,进行以下更改:

  • 更改以下 Unix 命令:
# Create clean environment
rm -rf newcerts
mkdir newcerts && cd newcerts

在 Windows 上,请改用以下命令:

# Create clean environment
md c:\newcerts
cd c:\newcerts
  • 当在命令行的末尾显示'\'字符时,必须删除此'\'字符,并且所有命令行都应在一行中 Importing。

生成证书和密钥文件后,要使用它们进行 SSL 连接,请参阅第 6.3.1 节“配置 MySQL 以使用加密连接”