C程序里通过SSL连接mysql失败

Question

因跨机房访问数据库，需要通过外网访问mysql数据库，安全考虑连接时需要进行SSL加密。问题如下：

通过命令行ssl外网连接数据库成功：

[xxxx@EM-F4W9B92]# mysql -u xxx -P 3310 -h xxxxx -p  --ssl-key=/opt/trader/client-key.pem --ssl-cert=/opt/trader/client-cert.pem
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or g.
Your MySQL connection id is 113278
Server version: 5.7.10-log Source distribution

改用C程序使用ssl连接，失败了：

SSL error: Unable to get certificate from '/opt/trader'
error:SSL connection error

C程序代码如下：

mysql_ssl_set(pConn, m_keySSL.c_str(), m_cert.c_str(), m_ca.c_str(), NULL, NULL);
MYSQL* pTmp = mysql_real_connect(pConn, ip.c_str(), user.c_str(), pwd.c_str(), name.c_str(), port, NULL, 0 );

其中keySSL=/opt/trader,cert=/opt/trader,ca=/opt/trader，及时分别加上文件名也是报同样的错误，请高手指点！！

Answer 1

引用来自“yizhiniu”的评论

如果在目录名后面证书文件名，报错：Unable to get Private Key，在网上找到这篇文章，明天去公司验证下

http://stackoverflow.com/questions/17704325/mysql-ssl-remote-connection-error-unable-to-get-private-key

查看密钥和重新生成密钥的命令：

1. Use 'openssl rsa -in key.pem -text' to get a printout of the private key.
2. remove a passphrase using openssl rsa -in key.pem -out key_unprot.pem

关于MYSQL中使SSL生效的问题：

http://askubuntu.com/questions/194074/enabling-ssl-in-mysql

官方文档API接口:

http://dev.mysql.com/doc/refman/5.7/en/mysql-real-connect.html

MYSQL *mysql_real_connect(MYSQL *mysql, const char *host, const char *user, const char *passwd, const char *db, unsigned int port, const char *unix_socket, unsigned long client_flag)

The value ofclient_flagis usually 0, but can be set to a combination of the following flags to enable certain features.

Answer 2

证书文件是有读写权限的

Answer 3

读写权限呢？

Answer 4

如果在目录名后面证书文件名，报错：Unable to get Private Key，在网上找到这篇文章，明天去公司验证下

http://stackoverflow.com/questions/17704325/mysql-ssl-remote-connection-error-unable-to-get-private-key

查看密钥和重新生成密钥的命令：

1. Use 'openssl rsa -in key.pem -text' to get a printout of the private key.
2. remove a passphrase using openssl rsa -in key.pem -out key_unprot.pem

关于MYSQL中使SSL生效的问题：

http://askubuntu.com/questions/194074/enabling-ssl-in-mysql

官方文档API接口:

http://dev.mysql.com/doc/refman/5.7/en/mysql-real-connect.html

MYSQL *mysql_real_connect(MYSQL *mysql, const char *host, const char *user, const char *passwd, const char *db, unsigned int port, const char *unix_socket, unsigned long client_flag)

The value ofclient_flagis usually 0, but can be set to a combination of the following flags to enable certain features.

Answer 5

SSL error: Unable to get certificate from '/opt/trader'  证书都放在/opt/trader目录下，mysql命令行都连接成功， 为什么还提示找不到证书？

Answer 6

使用mysql_ssl_set()，可采用SSL建立安全连接。必须在
mysql_real_connect()之前调用它。除非在客户端库中允许了OpenSSL支持，否则mysql_ssl_set()不作任何事。Mysql是从mysql_init()返回的连接处理程序。