0

I'm using certbot to generate a certificate for mariadb server and client ,but it's not working.

sudo certbot certonly -d mariadbserver -d mariadbuser

This is the command that i've used to generate certificates using certbot, I've got 4 files for both mariadbserver and mariadbuser . cert.pem,chain.pem,fullchain.pem,privkey.pem.

For the above 8 files i've created one certificates folder in /etc/my.cnf.d/certificates,First i've copied server files to this folder and renamed it for better understanding similarly did the same thing to client files also. my folder looks like

client-cert.pem client-chain.pem client-fullchain.pem client-privkey.pem server-cert.pem server-chain.pem server-fullchain.pem server-privkey.pem

then i executed

sudo chown -R mysql. /etc/my.cnf.d/certificates

I have added below snippets in server configuration i.e /etc/my.cnf

[mariadb]
ssl-ca= /etc/my.cnf.d/certificates/server-chain.pem
ssl-cert= /etc/my.cnf.d/certificates/server-cert.pem
ssl-key= /etc/my.cnf.d/certificates/server-privkey.pem

[client-mariadb]
ssl-ca= /etc/my.cnf.d/certificates/client-chain.pem
ssl-cert= /etc/my.cnf.d/certificates/client-cert.pem
ssl-key= /etc/my.cnf.d/certificates/client-privkey.pem

Then i've restarted mariadb server using sudo service mariadb restart.But after doing this when i login to mariadb, cipher is showing not in use.

I tried to combine cert as cat server-cert.pem client-cert.pem > ca-cert.pem and use it in ssl-ca= /etc/my.cnf.d/certificates/ca-cert.pem for both server and client CA. That's not working for me.

what should i do? am i doing anything wrong in the above steps.please help

Vijay
  • 1
  • 2
  • Try to use fullchain instead of serverchain – Romeo Ninov Aug 16 '22 at 13:47
  • Have you got any logs? Often you can find what's wrong in them. – Nikita Kipriyanov Aug 16 '22 at 13:50
  • Hi @RomeoNinov, fullchain is also not working for me. i tried to combine chain.pem and cert.pem and use it as certificate but that one is also not working. – Vijay Aug 17 '22 at 05:04
  • Hi @NikitaKipriyanov, i have included error log in the configuration, but no errors reported. i can able to login mariadb terminal. if i give `mariadb --help` in that it showing ssl -True, and i can see the path for all the 3 categories. but if i give `SHOW SESSION STATUS LIKE 'Ssl_cipher'` it is showing empty. and status also showing cipher not in use. – Vijay Aug 17 '22 at 05:09

0 Answers0