Mysql通过SSL安全连接证书配置

一、简介：

出于业务场景的安全稳定性方面考虑，即使是内网环境下，在应用连接Mysql的过程中，越来越多的会配置SSL证书，通过数据加密的方式连接数据库。如何配置jdbc来连接mysql ? 官方文档点击 这里。

二、Java应用程序配置

1.服务端认证

执行下面命令，将server-ca.pem文件导入keystore，如果有keystore文件，我这里名为cacerts，会自动添加。如果没有，会通过以下命令创建。

$ keytool.exe -importcert -alias cloudsql -file ../server-ca.pem -keystore cacerts -storepass changeit
Owner: C=US, O="Google, Inc", CN=Google Cloud SQL Server CA, DNQ=00c4cb96-6545-4c3b-bd87-7f3cf5f567da
Issuer: C=US, O="Google, Inc", CN=Google Cloud SQL Server CA, DNQ=00c4cb96-6545-4c3b-bd87-7f3cf5f567da
Serial number: 0
Valid from: Fri May 20 21:00:50 CST 2022 until: Mon May 17 21:01:50 CST 2032
Certificate fingerprints:
         SHA1: 35:CB:74:F6:74:DF:C8:0C:3B:40:91:FD:20:DB:4F:C7:6E:41:7F:A7
         SHA256: DC:AA:2B:D9:89:DB:65:3A:AA:77:18:D0:8F:96:04:6F:C8:08:29:AF:11:F2:54:65:2A:C4:7B:0D:3B:DA:59:03
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3

Extensions:

#1: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:true
  PathLen:0
]

Trust this certificate? [no]:  yes
Certificate was added to keystore

2.客户端认证

1）将client-cer.pem和client-key.pem转为p12格式

$ openssl pkcs12 -export -in ../client-cert.pem -inkey ../client-key.pem -name "cloudsqlclient" -passout pass:changeit -out client-keystore.p12

2）将转换的p12格式文件转为keystore文件client.jks

$ keytool.exe -importkeystore -srckeystore client-keystore.p12 -srcstoretype pkcs12 -srcstorepass changeit -destkeystore client.jks -deststoretype JKS -des tstorepass changeit
Importing keystore client-keystore.p12 to client.jks...
Entry for alias cloudsqlclient successfully imported.
Import command completed:  1 entries successfully imported, 0 entries failed or cancelled

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore client.jks -destkeystore client.jks -deststoretype pkcs12".

3.JDBC配置

  datasource:
    driver-class-name: org.mariadb.jdbc.Driver
    url: jdbc:mariadb://HOST:3306/DATABASE?verifyServerCertificate=true&useUnicode=true&characterEncoding=UTF-8&characterSetResults=UTF-8&useSSL=true&requireSSL=true&clientCertificateKeyStoreUrl=file:///opt/app/src/config/client.jks&clientCertificateKeyStorePassword=changeit&disableSslHostnameVerification=true
    username: ${SPRING_DATASOURCE_USERNAME}
    password: ${SPRING_DATASOURCE_PASSWORD}

三、Python应用程序配置

1.python程序连接mysql相对简单，只需要在JDBC字符串中配置如下内容即可

mysql://USER:PASSWORD@HOST:3306/DATABASE?ssl_key=/tmp/certs/client-key.pem&ssl_cert=/tmp/certs/client-cert.pem