Skip to content

check_local_certificates cannot find MySQL certs because they are in the data directory #33

Description

@lewart3

mysqltuner.pl with MySQL complains:
✘ Public Certificate file not found: server-cert.pem
✘ CA Certificate file not found: ca.pem

MySQL >= 5.7.5 automatically generates TLS certificate and key files in the data directory at startup:
  https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-5.html

mysql> SHOW VARIABLES LIKE 'ssl_%';
+---------------------------+--------------------------------+
| Variable_name             | Value                          |
+---------------------------+--------------------------------+
| ssl_ca                    | /var/lib/mysql/ca.pem          |
| ssl_cert                  | /var/lib/mysql/server-cert.pem |
+---------------------------+--------------------------------+

$ ls -dl /var/lib/mysql
drwxr-x--- 8 mysql mysql 4096 Dec 17 09:20 /var/lib/mysql

Those files can be seen only if the mysqltuner user is the mysql user or in the mysql group.
I think this is a bad idea for security reasons.

mysqltuner.pl should not complain if:

  • ssl_ca or ssL_cert are in the data directory
  • the mysqltuner user does not have access to that directory

Thank you!
Dan

Metadata

Metadata

Assignees

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions