你的MySQL服务器开启SSL了吗？

shell> bin/mysqld --initialize --user=mysql # MySQL 5.7.6 and up shell> bin/mysql_ssl_rsa_setup # MySQL 5.7.6 and up

[root mysql_data]# ll *.pem -rw------- 1 mysql mysql 1675 Jun 12 17:22 ca-key.pem #CA私钥 -rw-r--r-- 1 mysql mysql 1074 Jun 12 17:22 ca.pem #自签的CA证书，客户端连接也需要提供 -rw-r--r-- 1 mysql mysql 1078 Jun 12 17:22 client-cert.pem #客户端连接服务器端需要提供的证书文件 -rw------- 1 mysql mysql 1675 Jun 12 17:22 client-key.pem #客户端连接服务器端需要提供的私钥文件
-rw------- 1 mysql mysql 1675 Jun 12 17:22 private_key.pem #私钥/公钥对的私有成员
-rw-r--r-- 1 mysql mysql 451 Jun 12 17:22 public_key.pem #私钥/公钥对的共有成员
-rw-r--r-- 1 mysql mysql 1078 Jun 12 17:22 server-cert.pem #服务器端证书文件
-rw------- 1 mysql mysql 1675 Jun 12 17:22 server-key.pem #服务器端私钥文件

root> mysql -h 10.126.xxx.xxx -udba -p

###查看SSL开启情况

dba:(none)> show global variables like '%ssl%'; +---------------+-----------------+ | Variable_name | Value | +---------------+-----------------+ | have_openssl | YES | | have_ssl | YES   | #已经开启了SSL | ssl_ca | ca.pem | | ssl_capath | | | ssl_cert | server-cert.pem | | ssl_cipher | | | ssl_crl | | | ssl_crlpath | | | ssl_key | server-key.pem | +---------------+-----------------+

###查看dba连接的方式

dba:(none)> \s
--------------
/usr/local/mysql/bin/mysql Ver 14.14 Distrib 5.7.18, for linux-glibc2.5 (x86_64) using EditLine wrapper

Connection id: 2973
Current database:
Current user: dba@10.126.xxx.xxx
SSL: Cipher in use is DHE-RSA-AES256-SHA #表示该dba用户是采用SSL连接到mysql服务器上的，如果不是ssl，那么会显示“Not in use“
Current pager: more
Using outfile: ''
Using delimiter: ;
Server version: 5.7.18-log MySQL Community Server (GPL)
Protocol version: 10
Connection: 10.126.126.160 via TCP/IP
Server characterset: utf8
Db characterset: utf8
Client characterset: utf8
Conn. characterset: utf8
TCP port: 3306
Uptime: 2 hours 35 min 48 sec

1)、关闭MySQL服务 2)、运行mysql_ssl_rsa_setup 命令 3)、到data_dir目录下修改.pem文件的所属权限用户为mysql chown -R mysql.mysql *.pem 4)、启动MySQL服务

#修改已存在用户 ALTER USER 'dba'@'%' REQUIRE SSL; #新建必须使用SSL用户 grant select on *.* to 'dba'@'%' identified by 'xxx' REQUIRE SSL;

[root]# /usr/local/mysql/bin/mysql -udba -p -h10.126.xxx.xxx --ssl=0 Enter password: ERROR 1045 (28000): Access denied for user 'dba'@'10.126.xxx.xxx' (using password: YES)