SSL Certificates generation

[krisnik]

MySQL, starting from 5.7.5 version, automatically generates ssl keys and certificates and stores them in data directory.

I have installed mysql 5.7.17 using mysql docker image and I do not see certificates being generated in the default data directory.

Thanks in advance.

[ltangvald]

The image is missing openssl, which is needed to generate the files. I'll take a look at adding it (I think it will be automatic as long as openssl is present).

[krisnik]

Yes you are right. It would be great if that change can be made.

[tianon]

I've tested, and adding openssl will add ~5.89 MB to the image size. 👍

What I can't seem to get it to do though is generate the expected files -- according to https://dev.mysql.com/doc/refman/5.7/en/using-secure-connections.html and https://dev.mysql.com/doc/refman/5.7/en/creating-ssl-rsa-files-using-mysql.html, --ssl, auto_generate_certs, and sha256_password_auto_generate_rsa_keys should all be enabled by default, so shouldn't it be creating certificates? Is there something else that's necessary?

If I manually run mysql_ssl_rsa_setup, it appears to create the expected certificate files, but from what I can tell, this should be happening automatically by default with openssl installed. 😕

[tianon]

I got the following during my initial startup (after installing openssl, but before running mysql_ssl_rsa_setup):

2017-01-26T00:32:30.385878Z 0 [Warning] Failed to set up SSL because of the following SSL library error: SSL context is not usable without certificate and private key

Which changes to the following after I run mysql_ssl_rsa_setup manually:

2017-01-26T00:35:52.416989Z 0 [Note] Found ca.pem, server-cert.pem and server-key.pem in data directory. Trying to enable SSL support using them.
2017-01-26T00:35:52.417225Z 0 [Warning] CA certificate ca.pem is self signed.

[ltangvald]

Yeah, I was wrong about the automatic part. Basically, because of a potential license issue, the server doesn't link with openssl, so we need to run mysql_ssl_rsa_setup manually. In our deb packaging this is done in the service script rather than during installation: https://github.com/mysql/mysql-server/blob/5.7/packaging/deb-in/extra/mysql-systemd-start#L81

For now, maybe just include that if in the entrypoint script?

[krisnik]

Thank you @ltangvald for the quick turn around.