2.5. Configuring the MySQL client to use TLS encryption by default

Prerequisites

• The MySQL server has TLS support enabled.
• The CA certificate is stored in the /etc/pki/tls/certs/ca.crt.pem file on the client.

Procedure

• Create the /etc/my.cnf.d/mysql-client-tls.cnf file with the following content:

  [client]
  ssl-mode=VERIFY_IDENTITY
  ssl-ca=/etc/pki/tls/certs/ca.crt.pem

  These settings define that the MySQL client uses TLS encryption and that the client compares the hostname with the CN in the server certificate (ssl-mode=VERIFY_IDENTITY). Additionally, it specifies the path to the CA certificate (ssl-ca).

Verification

• Connect to the server using the hostname, and display the server status:

  # mysql -u root -p -h server.example.com -e status
  ...
  SSL:        Cipher in use is TLS_AES_256_GCM_SHA384

  If the SSL entry contains Cipher in use is…​, the connection is encrypted.

  Note that the user you use in this command has permissions to authenticate remotely.

  If the hostname you connect to does not match the hostname in the TLS certificate of the server, the ssl-mode=VERIFY_IDENTITY parameter causes the connection to fail. For example, if you connect to localhost:

  # mysql -u root -p -h localhost -e status
  ERROR 2026 (HY000): SSL connection error: error:0A000086:SSL routines::certificate verify failed