MySQL基于SSL协议进行主从复制的详细操作教程

mkdir /test/setup
cd /test/setup
tar zxvf openssl-0.9.8b.tar.gz
cd openssl-0.9.8b
./config
make && make install

mysql> show variables like '%ssl%'; 

+---------------+----------+ 
| Variable_name | Value  | 
+---------------+----------+ 
| have_openssl | DISABLED | 
| have_ssl   | DISABLED | 
| ssl_ca    |     | 
| ssl_capath  |     | 
| ssl_cert   |     | 
| ssl_cipher  |     | 
| ssl_key    |     | 
+---------------+----------+

ssl

mysql -uroot -p
mysql> show variables like '%ssl%'; 

+---------------+-------+ 
| Variable_name | Value | 
+---------------+-------+ 
| have_openssl | YES  | 
| have_ssl   | YES  | 
| ssl_ca    |    | 
| ssl_capath  |    | 
| ssl_cert   |    | 
| ssl_cipher  |    | 
| ssl_key    |    | 
+---------------+-------+

cd /etc/pki/CA

(umask 077;openssl genrsa -out /etc/pki/CA/private/cakey.pem 2048)

vim /etc/pki/tls/openssh.cnf

 [ req_distinguished_name ]
 countryName     = Country Name (2 letter code)
 countryName_default = CN
 countryName_min   = 2
 countryName_max   = 2
 stateOrProvinceName = State or Province Name (full name)
 stateOrpovinceName_default = FJ
 localityName    = Locality Name (eg,city)
 localityName    = FZ
 O.organizationName = Organization Name (eg,company)
 O.organizationName_default = zdz
 organizationalUnitName   = Organizational Unit Name (eg,section)
 organizationalUnitName_default = zdz

openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem -days 3650

vim /etc/pki/tls/openssl.cnf

 [ CA_defalut ]
 dir = /etc/pki/CA
 certs = $dir/certs   #存放生成证书的目录
 crl_dir = $dir/crl   #存放吊销证书的目录
 database = $dir/index.txt  #证书的索引文件
 new_certs_dir = $dir_newcerts  #新签的证书目录
 serial = $dir/serial  #序列号
 crl = $dir/crl.pem
 private_key = $dir/private/cakey.pem  #证书中心私钥文件

mkdir certs crl newcerts
 touch index.txt
 echo 00 > serial

mkdir /usr/local/mysql/ssl
 cd /usr/local/mysql/ssl
 (umask 077;openssl genrsa -out /usr/local/mysql/ssl/master.key 2048)

openssl req -new -key master.key -out master.csr

openssl ca -in master.csr -out master.crt -days 365

(umask 077;openssl genrsa -out /usr/local/mysql/ssl/slave.key 2048)
 openssl req -new -key slave.key -out slave.csr

opessl ca -in slave.csr -out slave.crt -days 356

cd /usr/local/mysql/ssl
 cp /etc/pki/CA/cacert.pem ./
 chown -R mysql:mysql master.crt master.key cacert.pem
 chmod 600 master.crt master.key cacert.pem
 vim /usr/local/mysql/my.cnf
 ssl
 ssl_ca         = /usr/local/mysql/ssl/cacrt.pem
 ssl_cert        = /usr/local/mysql/ssl/master.crt
 ssl_key         = /usr/local/mysql/ssl/master.key

cd /usr/local/mysql/ssl
 cp /etc/pki/CA/cacert.pem ./
 chown -R mysql:mysql slave.crt slave.key cacert.pem
 chmod 600 slave.crt slave.key cacert.pem
 vim /usr/local/mysql/my.cnf
 ssl
 ssl_ca         = /usr/local/mysql/ssl/cacrt.pem
 ssl_cert        = /usr/local/mysql/ssl/slave.crt
 ssl_key         = /usr/local/mysql/ssl/slave.key

grant replication slave on *.* to slave@'192.168.216.133' identified by 'slave' requere ssl;
 flush privileges;

mysql> show master status ;

 +-------------------------+------------+---------------------+--------------------------+--------------------------+
 | File              | Position | Binlog_Do_DB | Binlog_Ignore_DB | Executed_Gtid_Set |
 +-------------------------+------------+---------------------+--------------------------+--------------------------+
 | mysql-bin.000007 |   1015  |               |                  |                  |
 +-------------------------+------------+---------------------+--------------------------+---------------------------+
 1 row in set (0.00 sec)

change master to
 master_host='192.168.216.132',
 master_user='slave',
 master_password='slave',
 master_log_file='mysql-bin.000007',
 master_log_pos=1015,
 master_ssl=1,
 master_ssl_ca=' /usr/local/mysql/ssl/cacrt.pem',
 master_ssl_cert='/usr/local/mysql/ssl/slave.crt',
 master_ssl_key='/usr/local/mysql/ssl/slave.key';
 start slave;

grant all privileges on *.* to root@'192.168.216.133′ identified by ‘root' require ssl;

[root@slave ssl]# mysql -uroot -proot -h192.168.216.133 –ssl-ca=cacrt.pem –ssl-cert=slave.crt –ssl-key=slave.key

Warning: Using a password on the command line interface can be insecure.

ERROR 2026 (HY000): SSL connection error: ASN: before date in the future

[root@slave ssl]# mysql -uroot -proot -h192.168.216.133;

Warning: Using a password on the command line interface can be insecure.

ERROR 1045 (28000): Access denied for user ‘root'@'192.168.216.132′ (using password: YES)