lab environment
centos7.6 minimum REVERSE
Turn off the firewall, selinux
First, the establishment and generated CA certificate
1, generate the CA's private key
mkdir /etc/my.cnf.d/ssl
cd /etc/my.cnf.d/ssl
openssl genrsa 2048 > cakey.pem
2, CA self-signed certificate
openssl req -new -x509 -key cakey.pem -out cacert.pem -days 3650
3, the master node generates a certificate request private key and documents
openssl req -newkey rsa:1024 -days 365 -nodes -keyout master.key > master.csr
Generating a Certificate
openssl x509 -req -in master.csr -CA cacert.pem -CAkey cakey.pem -set_serial 01 > master.crt
4, the node generates a private key and certificate from the application documents
openssl req -newkey rsa:1024 -days 365 -nodes -keyout slave.key > slave.csr
Generating a Certificate
openssl x509 -req -in slave.csr -CA cacert.pem -CAkey cakey.pem -set_serial 02 > slave.crt
Copy [root @ localhost ssl] #scp -r /etc/my.cnf.d/ssl/ 192.168.12.27:/etc/my.cnf.d/ # from the server to the certificate
Second, the master-slave configuration SSL
MariaDB [(none)]> whether to view the status # ssl when the client logs
MariaDB [(none)]> show variables like '% ssl%'; # see if encryption is enabled
1, configure the master server
vi /etc/my.cnf # modify the configuration file
[mysqld] datadir=/var/lib/mysql log-bin server-id=57 ssl-ca=/etc/my.cnf.d/ssl/cacert.pem ssl-cert=/etc/my.cnf.d/ssl/master.crt ssl-key=/etc/my.cnf.d/ssl/master.key
systemctl restart mariadb
MariaDB [(none)]> show variables like '%ssl%'; #可以看到加密功能启用
mysql --ssl-ca=cacert.pem --ssl-cert=master.crt --ssl-key=master.key #客户端连接加密，证书如果不在当前路径需要，如果证书有问题会报错的
创建只允许ssl登录账号
MariaDB [(none)]> grant replication slave on *.* to repluser@'192.168.12.%' identified by '123456' require ssl;
[root@localhost ssl]#mysqldump -A -F --single-transaction --master-data=1 >all.sql #备份数据库
[root@localhost ssl]#scp all.sql 192.168.12.27:/
2、配置从服务器
vi /etc/my.cnf #修改配置文件
[mysqld] datadir=/var/lib/mysql server-id=27 read-only ssl-ca=/etc/my.cnf.d/ssl/cacert.pem ssl-cert=/etc/my.cnf.d/ssl/slave.crt ssl-key=/etc/my.cnf.d/ssl/slave.key
测试是否可以用ssl连接主服务器
mysql -urepluser -p123456 -h192.168.12.57 --ssl-ca=cacert.pem --ssl-cert=slave.crt --ssl-key=slave.key
vi /all.sql #在原有的基础上修改
CHANGE MASTER TO MASTER_HOST='192.168.12.57', MASTER_USER='repluser', MASTER_PASSWORD='123456', MASTER_SSL=1, MASTER_LOG_FILE='mariadb-bin.000009', MASTER_LOG_POS=245;
[root@localhost ssl]#mysql < /all.sql
MariaDB [(none)]> start slave;
MariaDB [(none)]> show slave status \ G # arranged in the configuration file are not shown here, then the certification path
If the certification path is specified in CHANGE MASTER TO the show slave status \ G is a certification path can be seen, there is no other difference
MariaDB [(none)]> show slave status\G
