问题描述
问题：尝试使用证书时，我无法在远程MySql服务器与本地计算机之间建立连接。
- Mysql版本：Ver 14.14 Distrib 5.7.31，适用于使用EditLine包装程序的Linux（x86_64）
- buntu 18.04.3 LTS
我已经在新的Ubuntu服务器上创建了新的Mysql实例。我已经创建了用户按脚本：
CREATE USER 'sammy'@'MY_COMPUTER_IP' IDENTIFIED WITH mysql_native_password BY 'password';
当我键入SHOW GLOBAL VARIABLES LIKE '%ssl%';时，我看到：
+---------------+--------------------------------+
| Variable_name | Value |
+---------------+--------------------------------+
| have_openssl | YES |
| have_ssl | YES |
| ssl_ca | /var/lib/mysql/ca.pem |
| ssl_capath | |
| ssl_cert | /var/lib/mysql/server-cert.pem |
| ssl_cipher | |
| ssl_crl | |
| ssl_crlpath | |
| ssl_key | /var/lib/mysql/server-key.pem |
+---------------+--------------------------------+
我还可以看到/ var / lib / mysql /中有（默认情况下）证书：
root@xxxxxx:/var/log/mysql# sudo find /var/lib/mysql -name '*.pem' -ls
258224 4 -rw------- 1 mysql mysql 1676 Aug 12 15:34 /var/lib/mysql/server-key.pem
258226 4 -rw------- 1 mysql mysql 1680 Aug 12 15:34 /var/lib/mysql/client-key.pem
258225 4 -rw------- 1 mysql mysql 1112 Aug 12 15:34 /var/lib/mysql/server-cert.pem
258227 4 -rw------- 1 mysql mysql 1112 Aug 12 15:34 /var/lib/mysql/client-cert.pem
258223 4 -rw------- 1 mysql mysql 2224 Aug 12 17:01 /var/lib/mysql/ca.pem
258523 4 -rw------- 1 mysql mysql 452 Aug 12 15:34 /var/lib/mysql/public_key.pem
258495 4 -rw------- 1 mysql mysql 1680 Aug 12 15:34 /var/lib/mysql/private_key.pem
258222 4 -rw------- 1 mysql mysql 1676 Aug 12 15:34 /var/lib/mysql/ca-key.pem
其/etc/mysql/my.cnf文件的外观如下：
!includedir /etc/mysql/conf.d/
!includedir /etc/mysql/mysql.conf.d/
[mysqld]
require_secure_transport = ON
bind-address = thie_is_myserver_address_ip
ssl-ca=/var/lib/mysql/ca.pem
ssl-cert=/var/lib/mysql/server-cert.pem
ssl-key=/var/lib/mysql/server-key.pem
更改后，我运行：
sudo systemctl restart mysql
我已将以下证书复制到本地计算机上：
- /var/lib/mysql/ca.pem
- /var/lib/mysql/client-cert.pem
- /var/lib/mysql/client-key.pem
我试图使用登录名，密码通过mysqlWorkbench登录，并且我将这3个证书添加到了SSL选项卡中，但是没有运气...
我现在收到错误：
SSL connection error: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca
错误日志（/var/log/mysql/error.log）：
2020-08-12T20:22:48.398042Z 0 [Warning] TIMESTAMP with implicit DEFAULT value is deprecated. Please use --explicit_defaults_for_timestamp server option (see documentation for more details).
2020-08-12T20:22:48.400817Z 0 [Note] /usr/sbin/mysqld (mysqld 5.7.31-0ubuntu0.18.04.1) starting as process 6428 ...
2020-08-12T20:22:48.407237Z 0 [Note] InnoDB: PUNCH HOLE support available
2020-08-12T20:22:48.407288Z 0 [Note] InnoDB: Mutexes and rw_locks use GCC atomic builtins
2020-08-12T20:22:48.407302Z 0 [Note] InnoDB: Uses event mutexes
2020-08-12T20:22:48.407312Z 0 [Note] InnoDB: GCC builtin __atomic_thread_fence() is used for memory barrier
2020-08-12T20:22:48.407322Z 0 [Note] InnoDB: Compressed tables use zlib 1.2.11
2020-08-12T20:22:48.407332Z 0 [Note] InnoDB: Using Linux native AIO
2020-08-12T20:22:48.407814Z 0 [Note] InnoDB: Number of pools: 1
2020-08-12T20:22:48.407982Z 0 [Note] InnoDB: Using CPU crc32 instructions
2020-08-12T20:22:48.412789Z 0 [Note] InnoDB: Initializing buffer pool,total size = 128M,instances = 1,chunk size = 128M
2020-08-12T20:22:48.426101Z 0 [Note] InnoDB: Completed initialization of buffer pool
2020-08-12T20:22:48.429598Z 0 [Note] InnoDB: If the mysqld execution user is authorized,page cleaner thread priority can be changed. See the man page of setpriority().
2020-08-12T20:22:48.442195Z 0 [Note] InnoDB: Highest supported file format is Barracuda.
2020-08-12T20:22:48.457283Z 0 [Note] InnoDB: Creating shared tablespace for temporary tables
2020-08-12T20:22:48.457488Z 0 [Note] InnoDB: Setting file './ibtmp1' size to 12 MB. Physically writing the file full; Please wait ...
2020-08-12T20:22:48.497583Z 0 [Note] InnoDB: File './ibtmp1' size is now 12 MB.
2020-08-12T20:22:48.499136Z 0 [Note] InnoDB: 96 redo rollback segment(s) found. 96 redo rollback segment(s) are active.
2020-08-12T20:22:48.499162Z 0 [Note] InnoDB: 32 non-redo rollback segment(s) are active.
2020-08-12T20:22:48.499694Z 0 [Note] InnoDB: Waiting for purge to start
2020-08-12T20:22:48.550043Z 0 [Note] InnoDB: 5.7.31 started; log sequence number 2721125
2020-08-12T20:22:48.550897Z 0 [Note] Plugin 'FEDERATED' is disabled.
2020-08-12T20:22:48.556599Z 0 [Note] InnoDB: Loading buffer pool(s) from /var/lib/mysql/ib_buffer_pool
2020-08-12T20:22:48.559994Z 0 [Note] InnoDB: Buffer pool(s) load completed at 200812 20:22:48
2020-08-12T20:22:48.569386Z 0 [Note] Skipping generation of SSL certificates as options related to SSL are specified.
2020-08-12T20:22:48.570843Z 0 [Note] Skipping generation of RSA key pair as key files are present in data directory.
2020-08-12T20:22:48.571010Z 0 [Note] Server hostname (bind-address): 'xx.xxx.xx.xx'; port: 3306
2020-08-12T20:22:48.571043Z 0 [Note] - 'xxx.xxx.xxx.xxx' resolves to 'xx.xx.xx.xx';
2020-08-12T20:22:48.571103Z 0 [Note] Server socket created on IP: 'xx.xx.xx.xx'.
2020-08-12T20:22:48.588243Z 0 [Note] Event Scheduler: Loaded 0 events
2020-08-12T20:22:48.588702Z 0 [Note] /usr/sbin/mysqld: ready for connections.
Version: '5.7.31-0ubuntu0.18.04.1' socket: '/var/run/mysqld/mysqld.sock' port: 3306 (Ubuntu)
2020-08-12T20:23:23.485022Z 2 [Note] Bad handshake
2020-08-12T20:24:27.578481Z 3 [Note] Bad handshake
当我尝试通过为客户端添加配置（在/etc/mysql/my.cnf文件中）在本地连接到远程服务器时：
[client]
ssl-ca=/var/lib/mysql/ca.pem
ssl-cert=/var/lib/mysql/client-cert.pem
ssl-key=/var/lib/mysql/client-key.pem
然后我重置了mysql，尝试从本地登录：
root@xxxxxx:/var/log/mysql# mysql -u root -p
Enter password:
ERROR 2026 (HY000): SSL connection error: error:00000001:lib(0):func(0):reason(1)
当我从my.cnf文件中删除证书路径时，它可以与opu证书一起正常工作。 但是我必须使用证书。
我做错了什么？谢谢您的指教！
解决方法
实际上我忘记了此命令
CREATE USER 'mysql_user'@'your_mysql_client_IP' IDENTIFIED BY 'password' REQUIRE X509;
我推荐这2个简单的教程，以使用SSL / TLS证书设置您的mysql数据库：
当前在第1点。全新安装已经包含生成的证书，因此您不必生成新的证书。如果您确实要生成新证书或要刷新旧证书（默认证书的有效期为356），则可以使用以下命令：
sudo mysql_ssl_rsa_setup --uid=mysql
或者您可以通过本教程手动生成它：
并将新证书放入此文件夹：
/var/lib/mysql/