content_image/698702.jpg
At startup, the MySQL server automatically uses the SSL files created by mysql_ssl_rsa_setup  to enable SSL if no explicit SSL options are given other than --ssl  (possibly along with ssl_cipher ). If you prefer to designate the files explicitly, invoke clients with the --ssl-ca , --ssl-cert , and -- ssl-key  options at startup to name the ca.pem , server-cert.pem , and server-key.pem  files, respectively. 

The server also automatically uses the RSA files created by mysql_ssl_rsa_setup  to enable RSA if no explicit RSA options are given. 

If the server is SSL-enabled, clients use SSL by default for the connection. To specify certificate and key files explicitly, use the --ssl-ca , --ssl-cert , and --ssl-key  options to name the ca.pem , client- cert.pem , and client-key.pem  files, respectively. However, some additional client setup may be required first because mysql_ssl_rsa_setup  by default creates those files in the data directory. The permissions for the data directory normally enable access only to the system account that runs the MySQL server, so client programs cannot use files located there. To make the files available, copy them to a directory that is readable (but not  writable) by clients: 

•For local clients, the MySQL installation directory can be used. For example, if the data directory is a subdirectory of the installation directory and your current location is the data directory, you can copy the files like this: 

cp ca.pem client-cert.pem client-key.pem .. 

•For remote clients, distribute the files using a secure channel to ensure they are not tampered with during transit. 

If the SSL files used for a MySQL installation have expired, you can use mysql_ssl_rsa_setup  to create new ones: 

1. Stop the server. 

2. Rename or remove the existing SSL files. You may wish to make a backup of them first. (The RSA files do not expire, so you need not remove them. mysql_ssl_rsa_setup  can see that they exist and does not overwrite them.) 

3. Run mysql_ssl_rsa_setup  with the --datadir  option to specify where to create the new files. 

4. Restart the server. 

mysql_ssl_rsa_setup  supports the following command-line options, which can be specified on the command line or in the [mysql_ssl_rsa_setup]  and [mysqld]  groups of an option file. For information about option files used by MySQL programs, see Section 4.2.2.2, “Using Option Files” . 

<img src='content_image/698702.jpg'>

• --help , ? 

Display a help message and exit. 

