MySQL 5.7 的SSL加密方法
MySQL 5.7.6或以上版本
（1）创建证书开启SSL验证
--安装openssl
yum install -y openssl
openssl version
OpenSSL 1.0.1e-fips 11 Feb 2013
--安装证书
/usr/local/mysql/bin/mysql_ssl_rsa_setup --datadir=/data/mysql/mysql3306/data
--修改权限
chown -R mysql:mysql /data/mysql/mysql3306/data
pwd
/data/mysql/mysql3306/data
[root@VM_45_133_centos Wed Jun 28 10:51:22 data]# ll
total 1024072
-rw-r----- 1 mysql mysql 56 Jun 19 17:56 auto.cnf
-rw------- 1 root root 1679 Jun 28 10:48 ca-key.pem
-rw-r--r-- 1 root root 1074 Jun 28 10:48 ca.pem
-rw-r--r-- 1 root root 1078 Jun 28 10:48 client-cert.pem
-rw------- 1 root root 1679 Jun 28 10:48 client-key.pem
-rw-r----- 1 mysql mysql 672 Jun 28 10:47 ib_buffer_pool
-rw-r----- 1 mysql mysql 1048576000 Jun 28 10:47 ibdata1
drwxr-x--- 2 mysql mysql 4096 Jun 19 17:57 mysql
drwxr-x--- 2 mysql mysql 4096 Jun 19 17:57 performance_schema
-rw------- 1 root root 1679 Jun 28 10:48 private_key.pem
-rw-r--r-- 1 root root 451 Jun 28 10:48 public_key.pem
drwxr-x--- 2 mysql mysql 4096 Jun 23 10:48 school
-rw-r--r-- 1 root root 1078 Jun 28 10:48 server-cert.pem
-rw------- 1 root root 1675 Jun 28 10:48 server-key.pem
drwxr-x--- 2 mysql mysql 12288 Jun 19 17:57 sys
-rw-r----- 1 mysql mysql 418 Jun 20 14:14 VM_45_133_centos.log
客户端连接需要的证书，当然不用证书也是可以的
-rw-r--r-- 1 root root 1074 Jun 28 10:48 ca.pem
-rw-r--r-- 1 root root 1078 Jun 28 10:48 client-cert.pem
-rw------- 1 root root 1679 Jun 28 10:48 client-key.pem
-rw------- 1 root root 1679 Jun 28 10:48 private_key.pem
服务器上的证书
-rw-r--r-- 1 root root 1074 Jun 28 10:48 ca.pem
-rw------- 1 root root 1679 Jun 28 10:48 ca-key.pem
-rw-r--r-- 1 root root 451 Jun 28 10:48 public_key.pem
-rw-r--r-- 1 root root 1078 Jun 28 10:48 server-cert.pem
-rw------- 1 root root 1675 Jun 28 10:48 server-key.pem
--修改my.cnf
#########SSL#############
ssl-ca = /data/mysql/mysql3306/data/ca.pem
ssl-cert = /data/mysql/mysql3306/data/server-cert.pem
ssl-key = /data/mysql/mysql3306/data/server-key.pem
（2）重启mysql
/etc/init.d/mysql stop
/etc/init.d/mysql start
--查看ssl参数状态，查看have_ssl，为YES，这表示已经开始支持SSL了
show global variables like '%ssl%';
+---------------+--------------------------------------------+
| Variable_name | Value |
+---------------+--------------------------------------------+
| have_openssl | YES |
| have_ssl | YES |
| ssl_ca | /data/mysql/mysql3306/data/ca.pem |
| ssl_capath | |
| ssl_cert | /data/mysql/mysql3306/data/server-cert.pem |
| ssl_cipher | |
| ssl_crl | |
| ssl_crlpath | |
| ssl_key | /data/mysql/mysql3306/data/server-key.pem |
+---------------+--------------------------------------------+
show global status like '%ssl%';
+--------------------------------+--------------------------+
| Variable_name | Value |
+--------------------------------+--------------------------+
| Com_show_processlist | 0 |
| Ssl_accept_renegotiates | 0 |
| Ssl_accepts | 0 |
| Ssl_callback_cache_hits | 0 |
| Ssl_cipher | |
| Ssl_cipher_list | |
| Ssl_client_connects | 0 |
| Ssl_connect_renegotiates | 0 |
| Ssl_ctx_verify_depth | 0 |
| Ssl_ctx_verify_mode | 0 |
| Ssl_default_timeout | 0 |
| Ssl_finished_accepts | 0 |
| Ssl_finished_connects | 0 |
| Ssl_server_not_after | Jun 26 02:48:05 2027 GMT |
| Ssl_server_not_before | Jun 28 02:48:05 2017 GMT |
| Ssl_session_cache_hits | 0 |
| Ssl_session_cache_misses | 0 |
| Ssl_session_cache_mode | Unknown |
| Ssl_session_cache_overflows | 0 |
| Ssl_session_cache_size | 0 |
| Ssl_session_cache_timeouts | 0 |
| Ssl_sessions_reused | 0 |
| Ssl_used_session_cache_entries | 0 |
| Ssl_verify_depth | 0 |
| Ssl_verify_mode | 0 |
| Ssl_version | |
+--------------------------------+--------------------------+
查看SSL的加密方式
show global variables like 'tls_version';
+---------------+---------------+
| Variable_name | Value |
+---------------+---------------+
| tls_version | TLSv1,TLSv1.1 |
+---------------+---------------+
（3）配置SSL用户
取消ssl验证
grant all privileges on *.* to abcssl@'%' identified by '123456' require none;
alter user abcssl@'%' require none;
--强制ssl验证，即使设置了强制ssl，在登录时候使用--ssl-mode=disable依然可以避开ssl验证
grant all privileges on *.* to abcssl@'%' identified by '123465' require ssl;
alter user abcssl@'%' require ssl;
查看是否开启强制用户使用SSL
select user,host,ssl_type,ssl_cipher from mysql.user;
+-----------+-----------+----------+------------+
| user | host | ssl_type | ssl_cipher |
+-----------+-----------+----------+------------+
| root | % | | |
| mysql.sys | localhost | | |
| abcssl | % | ANY | |
+-----------+-----------+----------+------------+
（4）连接数据库的时候，带上SSL
不指定客户端证书方式
5.6
--ssl、--disable-ssl、--skip-ssl：在mysql5.7是将被废弃的选项，将来版本不再支持，建议使用--ssl-mode选项，
/usr/local/mysql/bin/mysql -uroot -p -h127.0.0.1 --ssl 默认为1
/usr/local/mysql/bin/mysql -uroot -p -h127.0.0.1 --ssl=0
/usr/local/mysql/bin/mysql -uroot -p -h127.0.0.1 --ssl=1 默认为1
/usr/local/mysql/bin/mysql -uroot -p -h127.0.0.1 --disable-ssl
/usr/local/mysql/bin/mysql -uroot -p -h127.0.0.1 --skip-ssl
5.7
/usr/local/mysql/bin/mysql -uroot -p -h127.0.0.1 --ssl-mode=disable
/usr/local/mysql/bin/mysql -uroot -p -h127.0.0.1 --ssl-mode=required 默认required
从另一台机器连接过去也可以ssl加密，表明不需要安装客户端证书的
/usr/local/mysql/bin/mysql -uroot -p -h10.105.45.133 --ssl-mode=required
指定客户端证书方式，5.6的方式，5.7也可以用
/usr/local/mysql/bin/mysql --ssl-ca=/data/mysql/mysql3306/data/ca.pem
--ssl-cert=/data/mysql/mysql3306/data/client-cert.pem
--ssl-key=/data/mysql/mysql3306/data/client-key.pem
-uroot -p -h127.0.0.1
（5）连接验证连接是否用了ssl
s == status
--------------
/usr/local/mysql/bin/mysql Ver 14.14 Distrib 5.7.18, for linux-glibc2.5 (x86_64) using EditLine wrapper 客户端版本
Connection id: 69
Current database:
Current user: root@127.0.0.1
SSL: Cipher in use is DHE-RSA-AES256-SHA
Current pager: stdout
Using outfile: ''
Using delimiter: ;
Server version: 5.7.18-log MySQL Community Server (GPL)
Protocol version: 10
Connection: 127.0.0.1 via TCP/IP
Server characterset: utf8mb4
Db characterset: utf8mb4
Client characterset: utf8
Conn. characterset: utf8
TCP port: 3306
Uptime: 28 min 14 sec
Threads: 2 Questions: 1755 Slow queries: 0 Opens: 114 Flush tables: 1 Open tables: 102 Queries per second avg: 1.036
--------------
JDBC客户端的解决方法
连接字符串url中加入ssl=true或false：
url=jdbc:mysql://127.0.0.1:3306/framework?characterEncoding=utf8&useSSL=true