Support requiring SSL, and verifying CA, for MySQL#703
Conversation
754c8c0 to
42ff300
Compare
42ff300 to
2a97f3e
Compare
|
The change in #730 addresses very basic SSL on/off control for dbmate with MySQL and MariaDB. No support for CA certificates was implemented there. Personally, my opinion is rather than trying to shoehorn a menagerie of configuration knobs onto |
|
Also: it would be nice to better support CA certificate handling for SSL/TLS connections for all our drivers, not just MySQL. What I mean is, I would prefer a solution that was generalized at the interface level, and each driver implements the necessary mechanism to provide the functionality. |
This PR adds support for requiring a secure connection and man-in-the-middle protection in the form of the
DBMATE_MYSQL_SSL_MODEandDBMATE_MYSQL_CA_PATHparameter.DBMATE_MYSQL_SSL_MODEis an implementation of https://dev.mysql.com/doc/refman/8.4/en/connection-options.html#option_general_ssl-modeDBMATE_MYSQL_CA_PATHimplements https://dev.mysql.com/doc/refman/8.4/en/connection-options.html#option_general_ssl-caThis PR will also fix tests failing on the main branch due to certificate verification problems.
Important caveat, the CLI parameter
--ssl-modeused for mysqldump is not present in mariadb dump. If there is a way to detect whether mariadb-dump is used, I could change the parameters accordingly but there does not seem to be a distinction at the moment. Suggestions welcome.I'll refrain from further work until there is some feedback on the approach and whether there is interest in this change.
Todo: