Scenario: Authenticating MySQL Server

We recommend that you use a TLS certificate to authenticate the MySQL server. You can use a certificate from a trusted certification authority (CA) or a self-signed certificate. Use a certificate from a trusted CA because a self-signed certificate provides only limited protection.

Administration Server supports both one-way and two-way SSL authentication for MySQL.

Enable one-way SSL authentication

Follow these steps to configure one-way SSL authentication for MySQL:

1. Navigate to the ServerFlags directory and create a file that corresponds to the KLSRV_MYSQL_OPT_SSL_CA server flag:

   cd /etc/opt/kaspersky/klnagent_srv/1093/1.0.0.0/ServerFlags/

   mkfile KLSRV_MYSQL_OPT_SSL_CA

2. In the KLSRV_MYSQL_OPT_SSL_CA file, specify the path to the certificate (the ca-cert.pem file).
3. Specify the certificates in the my.cnf file. Open the my.cnf file in a text editor and add the following lines into the [mysqld] section:

   [mysqld]

   ssl-ca="C:/mysqlCerts/ca-cert.pem"

   ssl-cert="C:/mysqlCerts/server-cert.pem"

   ssl-key="C:/mysqlCerts/server-key.pem"

Enable two-way SSL authentication

Follow these steps to configure two-way SSL authentication for MySQL:

1. Navigate to the ServerFlags directory and create files that correspond to the server flags:

   cd /etc/opt/kaspersky/klnagent_srv/1093/1.0.0.0/ServerFlags/

   mkfile KLSRV_MYSQL_OPT_SSL_CA

   mkfile KLSRV_MYSQL_OPT_SSL_CERT

   mkfile KLSRV_MYSQL_OPT_SSL_KEY

2. Edit the created files as follows:

   KLSRV_MYSQL_OPT_SSL_CA: specify the path to the ca-cert.pem file.

   KLSRV_MYSQL_OPT_SSL_CERT: specify the path to the server-cert.pem file.

   KLSRV_MYSQL_OPT_SSL_KEY: specify the path to the server-key.pem file.

   If the server-key.pem requires a passphrase, create a KLSRV_MARIADB_OPT_TLS_PASPHRASE file in the ServerFlags folder and specify the passphrase in it.

3. Specify the certificates in the my.cnf file. Open the my.cnf file in a text editor and add the following lines into the [mysqld] section:

   [mysqld]

   ssl-ca="C:/mysqlCerts/ca-cert.pem"

   ssl-cert="C:/mysqlCerts/server-cert.pem"

   ssl-key="C:/mysqlCerts/server-key.pem"