How to use encrypted connection with MySQL on Docker - mysql

Question

I'm struggling to get a Dockerised MySQL instance to support SSL.
The service in my docker-compose file looks like this:
mysql:
image: mysql:5.7
container_name: mysql
command: --default-authentication-plugin=mysql_native_password --ssl-ca=/etc/ssl/mysql/ca.pem --ssl-cert=/etc/ssl/mysql/server-cert.pem --ssl-key=/etc/ssl/mysql/server-key.pem
restart: always
expose:
- 3306
environment:
MYSQL_ROOT_PASSWORD: "${MYSQL_ROOT_PASSWORD}"
MYSQL_DATABASE: "${MYSQL_DATABASE}"
MYSQL_USER: "${MYSQL_USER}"
MYSQL_PASSWORD: "${MYSQL_PASSWORD}"
volumes:
- "./data/db:/var/lib/mysql"
- "./config/mysql/my.cnf:/etc/mysql/conf.d/ssl.cnf"
- "./config/mysql/certs:/etc/ssl/mysql"
When I start up the stack I get these errors from the MySQL container:
[ERROR] SSL error: Unable to get private key from '/etc/ssl/mysql/server-key.pem'
[Warning] Failed to set up SSL because of the following SSL library error: Unable to get private key
I've tried to chown the key from root to mysql and then bring up the stack again, but that doesn't seem to work.
I generated the key files from the commands at https://dev.mysql.com/doc/refman/5.7/en/creating-ssl-files-using-openssl.html, like this:
# Create server certificate, remove passphrase, and sign it
# server-cert.pem = public key, server-key.pem = private key
openssl req -newkey rsa:2048 -days 3600 \
-nodes -keyout server-key.pem -out server-req.pem
openssl rsa -in server-key.pem -out server-key.pem
openssl x509 -req -in server-req.pem -days 3600 \
-CA ca.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem
The files on the host have the following permissions:
drwxrwxr-x 2 andrew andrew 4096 Dec 11 10:25 ./
drwxrwxr-x 3 andrew andrew 4096 Dec 10 19:27 ../
-rw-rw-r-- 1 999 docker 1675 Dec 10 19:20 ca-key.pem
-rw-rw-r-- 1 999 docker 1294 Dec 10 19:20 ca.pem
-rw-rw-r-- 1 999 docker 1123 Dec 10 19:20 client-cert.pem
-rw-rw-r-- 1 999 docker 1679 Dec 10 19:20 client-key.pem
-rw-rw-r-- 1 999 docker 989 Dec 10 19:20 client-req.pem
-rw-rw-r-- 1 999 docker 1127 Dec 10 19:20 server-cert.pem
-rw------- 1 999 docker 1675 Dec 11 10:25 server.key
-rw-rw-r-- 1 999 docker 1704 Dec 11 09:43 server-key.pem
-rw-rw-r-- 1 999 docker 956 Dec 11 09:43 server-req.pem
This happens if I manually generate the certificates and mount them as a volume, or if I run a shell on the container and run the command mysql_ssl_rsa_setup --datadir=/etc/ssl/mysql --verbose (after clearing out the certificates that I created). In other words when I run openssl verify -CAfile ca.pem server-cert.pem client-cert.pem I see that both certificates are "OK" (no matter which way I generate them).
Why can't MySQL find the private key from that file?

Answer 1

There were two problems.
When I generated the certificate it had the wrong permissions. Running chown 999:docker on the certificates helps let MySQL read it in the container. When I was using the MySQL tool to generate certificates I was skipping this step.
The second problem was that the common name (CN) of the CA certificate needs to be different from the CN of the server certificate.
In the section where it gives the commands to generate the certificates, the MySQL manual says:
To generate test files, you can press Enter to all prompts. To
generate files for production use, you should provide nonempty
responses.
But a little higher on the page it has a warning about the CN needing to be different.