mysql主从复制加密

ca,master,slave 证书

-- 证书生成的目录
mkdir /etc/my.cnf.d/ssl
-- 利用 rsa算法生成一个 2048位的私钥,没有加密
openssl genrsa 2048 > cakey.pem  
-- 利用私钥自签名一个证书，ca自己的证书
openssl req -new -x509 -key cakey.pem -out cacert.pem -days 3650 

-- master的证书申请文件
openssl req -newkey rsa:1024 -days 365 -nodes -keyout master.key > master.csr  
-- 颁发证书，证书编号为01，master的证书
openssl x509 -req -in master.csr -CA cacert.pem -CAkey cakey.pem -set_serial 01 > master.crt

-- slave的证书申请文件
openssl req -newkey rsa:1024 -days 365 -nodes -keyout slave.key > slave.csr
-- 颁发证书，证书编号为02，slave的证书
openssl x509 -req -in slave.csr -CA cacert.pem -CAkey cakey.pem -set_serial 02 > slave.crt

master 的配置

配置文件

vim /etc/my.cnf	
[mysqld]
server_id=7
log_bin=/data/logbin/mariadb-bin
ssl-ca=/etc/my.cnf.d/ssl/cacert.pem
ssl-cert=/etc/my.cnf.d/ssl/master.crt
ssl-key=/etc/my.cnf.d/ssl/master.key

将证书目录拷贝至从节点

scp -r /etc/my.cnf.d/ssl/ 192.168.43.17:/etc/my.cnf.d/

远程用户强制使用ssl

MariaDB [(none)]> grant replication slave on *.* to repluser2@'192.168.43.%' identified by 'centos' require ssl;

slave的配置

配置文件

vim /etc/my.cnf
[mysqld]
server_id=17
ssl-ca=/etc/my.cnf.d/ssl/cacert.pem
ssl-cert=/etc/my.cnf.d/ssl/slave.crt
ssl-key=/etc/my.cnf.d/ssl/slave.key

指定连接主的用户，二进制文件，位置

MariaDB [(none)]> CHANGE MASTER TO
MASTER_HOST='192.168.43.7',
MASTER_USER='repluser2',
MASTER_PASSWORD='centos',
MASTER_LOG_FILE='mariadb-bin.000005',
MASTER_LOG_POS=584,
MASTER_SSL=1,
MASTER_SSL_CA = '/etc/my.cnf.d/ssl/cacert.pem',
MASTER_SSL_CERT = '/etc/my.cnf.d/ssl/slave.crt',
MASTER_SSL_KEY = '/etc/my.cnf.d/ssl/slave.key';