MySQL TLS

验证：未记录

适用版本: 未记录
验证范围: 尚未登记验证记录。

本文缩写（英文全称与中文含义）

缩写	英文全称／名称	中文含义
CA	Certificate Authority	证书颁发机构
DSN	Data Source Name	数据源名称／数据库连接配置
JDBC	Java Database Connectivity	Java 数据库连接接口
TLS	Transport Layer Security	传输层安全协议
URL	Uniform Resource Locator	统一资源定位符，通常指访问地址

Links#

https://dev.mysql.com/doc/refman/8.4/en/using-encrypted-connections.html
https://dev.mysql.com/doc/refman/8.4/en/encrypted-connection-protocols-ciphers.html
https://dev.mysql.com/doc/refman/8.4/en/creating-ssl-rsa-files.html
https://dev.mysql.com/doc/refman/8.4/en/connection-options.html

1. Important Points#

MySQL 支持 TLS 加密连接。生产环境里，重点不是“能连上”，而是“强制加密 + 验证 CA + 验证主机名”。

生产连接不仅要加密，还应校验服务端身份；不要用 ssl-mode=DISABLED 或关闭证书验证来解决 TLS 失败。

server side:
    enable encrypted connections
    require secure transport for client connections

client side:
    use VERIFY_CA or VERIFY_IDENTITY
    pin CA certificate
    verify server hostname when possible

do not do this in production:
    ssl-mode=DISABLED
    rejectUnauthorized=false
    insecure_skip_verify

2. Server Configuration#

常见服务端配置：

[mysqld]
require_secure_transport=ON
tls_version=TLSv1.2,TLSv1.3
ssl_ca=/etc/mysql/certs/ca.pem
ssl_cert=/etc/mysql/certs/server-cert.pem
ssl_key=/etc/mysql/certs/server-key.pem

file layout:
    /etc/mysql/certs/ca.pem
    /etc/mysql/certs/server-cert.pem
    /etc/mysql/certs/server-key.pem

permissions:
    private key should be readable only by mysql process owner
    certificate files should not be world-writable

检查当前状态：

SHOW VARIABLES LIKE 'require_secure_transport';
SHOW VARIABLES LIKE 'tls_version';
SHOW VARIABLES LIKE 'have_ssl';

note:
    MySQL 8.4 supports TLSv1.2 and TLSv1.3 for connections

3. Client Configuration / Verify#

推荐用客户端显式验证：

mysql --host=db.example.com --user=shop_app --password --ssl-mode=VERIFY_IDENTITY --ssl-ca=/etc/mysql/certs/ca.pem -e "SHOW STATUS LIKE 'Ssl_cipher';"

如果不方便做主机名校验，最低也要做 CA 校验：

mysql --host=db.example.com --user=shop_app --password --ssl-mode=VERIFY_CA --ssl-ca=/etc/mysql/certs/ca.pem

验证当前会话：

SHOW STATUS LIKE 'Ssl_cipher';
SHOW STATUS LIKE 'Ssl_version';

4. Java#

JDBC URL example:
    jdbc:mysql://db.example.com:3306/shop?sslMode=VERIFY_IDENTITY&enabledTLSProtocols=TLSv1.2,TLSv1.3

recommendation:
    trust the server CA
    keep hostname verification on

5. Python#

mysql-connector-python style:
    ssl_ca=/etc/mysql/certs/ca.pem
    ssl_verify_cert=True
    ssl_verify_identity=True

6. Go#

go-sql-driver/mysql style:
    register a tls.Config with RootCAs and ServerName
    use tls=custom in the DSN

7. Node.js#

mysql2 style:
    ssl:
        ca: fs.readFileSync('/etc/mysql/certs/ca.pem')
        rejectUnauthorized: true