Securing MySQL installations with SSL/TLS connections
Jul 13, 2025 am 02:16 AMTo configure MySQL's SSL/TLS encrypted connection, first generate a self-signed certificate and correctly configure the server and client settings. 1. Use OpenSSL to generate CA private key, CA certificate, server private key and certificate request, and self-sign the server certificate; 2. Place the generated certificate file in the specified directory, and restart MySQL after configuring the ssl-ca, ssl-cert and ssl-key parameters in my.cnf or mysqld.cnf; 3. Force SSL on the client, restrict users from connecting only through SSL through the GRANT USAGE command, or specify the --ssl-mode=REQUIRED parameter when connecting; 4. After logging in, execute \s to check the SSL status to confirm that the encrypted connection is effective. Notes include: Check the logs to ensure the certificate path is correct, regularly changing the certificate, optionally configuring two-way authentication, and paying attention to performance impact. These steps can effectively improve the security of MySQL database communication.
The MySQL database is transmitted in plaintext by default, which means that if someone intercepts the communication traffic in the middle, you can see the database username, password, and even query statements. To prevent this, it is very necessary to enable SSL/TLS encrypted connections. It not only protects data security, but also enhances authentication and ensures that the client is connected to a legitimate server.

Here are some practical suggestions to help you properly configure MySQL's SSL/TLS connection.

How to generate and configure MySQL's SSL certificates
MySQL supports the use of OpenSSL to generate self-signed certificates, or use formal certificates issued by CA. Here are the steps to generate a basic self-signed certificate:
- Use the following command to generate the CA private key:
openssl genrsa 2048 > ca-key.pem
- Generate a CA certificate:
openssl req -new -x509 -nodes -days 3650 -key ca-key.pem -out ca-cert.pem
- Generate server private key and certificate request:
openssl genrsa 2048 > server-key.pem openssl req -new -key server-key.pem -out server-req.pem
- Self-signed server certificate:
openssl x509 -req -days 3650 -in server-req.pem -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem
Put these files into the directory specified in the MySQL configuration (such as /etc/mysql/ssl
), and then add the following content to my.cnf
or mysqld.cnf
:

[mysqld] ssl-ca=/etc/mysql/ssl/ca-cert.pem ssl-cert=/etc/mysql/ssl/server-cert.pem ssl-key=/etc/mysql/ssl/server-key.pem
After restarting MySQL, SSL takes effect.
How to force SSL connections to a client
SSL is not enough for the server to support SSL, and it is necessary to ensure that the encrypted channel is used when connecting to the client. You can do this in several ways:
Modify user permissions : Execute the following statement in MySQL to force a user to connect only through SSL:
GRANT USAGE ON *.* TO 'secure_user'@'%' REQUIRE SSL; FLUSH PRIVILEGES;
In this way, any connection attempt without SSL will be denied.
Specify SSL parameters when connecting : For example, add
--ssl-mode=REQUIRED
parameter when connecting using a command line client or program:mysql -u secure_user -p --host=db.example.com --ssl-mode=REQUIRED
Check whether SSL is enabled : Execute after logging in:
\s
Check
SSL
line in the output to confirm whether the current connection is using encryption.
After this setting, it can effectively prevent man-in-the-middle attacks and improve overall security.
Frequently Asked Questions and Precautions
Although the configuration process seems simple, there are several error-prone areas to pay attention to during the actual deployment process:
- Certificate path error : MySQL will not automatically report a certificate path error when starting, and will only be silently ignored. So be sure to check
error.log
and permission settings. - Certificate expiration time : In the example above, we set a 10-year validity period, but in a production environment, it is recommended to replace the certificate regularly.
- Client Certificate Verification (Boundary Authentication) : If you need higher levels of security control, you can let the client provide certificates as well, which requires additional options such as
REQUIRE X509
orISSUER
. - Performance impact is not great : Although SSL/TLS will bring some encryption and decryption overhead, it can be almost ignored in modern hardware environments.
These details are especially important especially when your database is exposed to public networks or accessed across data centers.
Basically that's it. As long as the certificate is configured correctly and the user permissions are set in place, SSL/TLS can protect your MySQL communications very well.
The above is the detailed content of Securing MySQL installations with SSL/TLS connections. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

mysqldump is a common tool for performing logical backups of MySQL databases. It generates SQL files containing CREATE and INSERT statements to rebuild the database. 1. It does not back up the original file, but converts the database structure and content into portable SQL commands; 2. It is suitable for small databases or selective recovery, and is not suitable for fast recovery of TB-level data; 3. Common options include --single-transaction, --databases, --all-databases, --routines, etc.; 4. Use mysql command to import during recovery, and can turn off foreign key checks to improve speed; 5. It is recommended to test backup regularly, use compression, and automatic adjustment.

When handling NULL values ??in MySQL, please note: 1. When designing the table, the key fields are set to NOTNULL, and optional fields are allowed NULL; 2. ISNULL or ISNOTNULL must be used with = or !=; 3. IFNULL or COALESCE functions can be used to replace the display default values; 4. Be cautious when using NULL values ??directly when inserting or updating, and pay attention to the data source and ORM framework processing methods. NULL represents an unknown value and does not equal any value, including itself. Therefore, be careful when querying, counting, and connecting tables to avoid missing data or logical errors. Rational use of functions and constraints can effectively reduce interference caused by NULL.

GROUPBY is used to group data by field and perform aggregation operations, and HAVING is used to filter the results after grouping. For example, using GROUPBYcustomer_id can calculate the total consumption amount of each customer; using HAVING can filter out customers with a total consumption of more than 1,000. The non-aggregated fields after SELECT must appear in GROUPBY, and HAVING can be conditionally filtered using an alias or original expressions. Common techniques include counting the number of each group, grouping multiple fields, and filtering with multiple conditions.

MySQL paging is commonly implemented using LIMIT and OFFSET, but its performance is poor under large data volume. 1. LIMIT controls the number of each page, OFFSET controls the starting position, and the syntax is LIMITNOFFSETM; 2. Performance problems are caused by excessive records and discarding OFFSET scans, resulting in low efficiency; 3. Optimization suggestions include using cursor paging, index acceleration, and lazy loading; 4. Cursor paging locates the starting point of the next page through the unique value of the last record of the previous page, avoiding OFFSET, which is suitable for "next page" operation, and is not suitable for random jumps.

MySQL supports transaction processing, and uses the InnoDB storage engine to ensure data consistency and integrity. 1. Transactions are a set of SQL operations, either all succeed or all fail to roll back; 2. ACID attributes include atomicity, consistency, isolation and persistence; 3. The statements that manually control transactions are STARTTRANSACTION, COMMIT and ROLLBACK; 4. The four isolation levels include read not committed, read submitted, repeatable read and serialization; 5. Use transactions correctly to avoid long-term operation, turn off automatic commits, and reasonably handle locks and exceptions. Through these mechanisms, MySQL can achieve high reliability and concurrent control.

To view the size of the MySQL database and table, you can query the information_schema directly or use the command line tool. 1. Check the entire database size: Execute the SQL statement SELECTtable_schemaAS'Database',SUM(data_length index_length)/1024/1024AS'Size(MB)'FROMinformation_schema.tablesGROUPBYtable_schema; you can get the total size of all databases, or add WHERE conditions to limit the specific database; 2. Check the single table size: use SELECTta

Character set and sorting rules issues are common when cross-platform migration or multi-person development, resulting in garbled code or inconsistent query. There are three core solutions: First, check and unify the character set of database, table, and fields to utf8mb4, view through SHOWCREATEDATABASE/TABLE, and modify it with ALTER statement; second, specify the utf8mb4 character set when the client connects, and set it in connection parameters or execute SETNAMES; third, select the sorting rules reasonably, and recommend using utf8mb4_unicode_ci to ensure the accuracy of comparison and sorting, and specify or modify it through ALTER when building the library and table.

To set up asynchronous master-slave replication for MySQL, follow these steps: 1. Prepare the master server, enable binary logs and set a unique server-id, create a replication user and record the current log location; 2. Use mysqldump to back up the master library data and import it to the slave server; 3. Configure the server-id and relay-log of the slave server, use the CHANGEMASTER command to connect to the master library and start the replication thread; 4. Check for common problems, such as network, permissions, data consistency and self-increase conflicts, and monitor replication delays. Follow the steps above to ensure that the configuration is completed correctly.
