<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="mysql-cluster-tls-keys">
      </a>
      25.6.15.2 Creating a CA and Keys
     </h4>
    </div>
   </div>
  </div>
  <p>
   Create a CA in the CA directory:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa57746908"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">ndb_sign_keys</span> <span class="token property">--create-CA</span> <span class="token constant">--to-dir</span><span class="token attr-value"><span class="token punctuation">=</span>CA</span>
Mode of operation<span class="token punctuation">:</span> create CA<span class="token punctuation">.</span>
This utility will create a cluster CA private key and a public key certificate<span class="token punctuation">.</span>

You will be prompted to supply a pass phrase to protect the
cluster private key<span class="token punctuation">.</span> This security of the cluster depends on this<span class="token punctuation">.</span>

Only the database administrator responsible for this cluster should
have the pass phrase<span class="token punctuation">.</span> Knowing the pass phrase would allow an attacker
to gain full access to the database<span class="token punctuation">.</span>

The passphrase must be at least 4 characters in length<span class="token punctuation">.</span>

Creating CA key file NDB-Cluster-private-key in directory CA<span class="token punctuation">.</span>
Enter PEM pass phrase<span class="token punctuation">:</span> Verifying - Enter PEM pass phrase<span class="token punctuation">:</span>
Creating CA certificate NDB-Cluster-cert in directory CA<span class="token punctuation">.</span>
<span class="token prompt">$&gt; </span><span class="token command">ls</span> <span class="token property">-l</span> CA
total 8
<span class="token property">-rw-r--r--</span> 1 mysql mysql 1082 Dec 19 07<span class="token punctuation">:</span>32 NDB-Cluster-cert
<span class="token property">-r--------</span> 1 mysql mysql 1854 Dec 19 07<span class="token punctuation">:</span>32 NDB-Cluster-private-key</code></pre>
  </div>
  <p>
   Next, create keys for all nodes on this host using the
   <a class="link" href="mysql-cluster-programs-ndb-sign-keys.html#option_ndb_sign_keys_create-key">
    <code class="option">
     --create-key
    </code>
   </a>
   option, like
        this:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa89658585"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">ndb_sign_keys</span> <span class="token constant">--ndb-tls-search-path</span>=<span class="token atrule">'CA'</span> <span class="token property">--create-key</span> <span class="token property">-c</span> localhost<span class="token punctuation">:</span>1186 <span class="token constant">--to-dir</span><span class="token attr-value"><span class="token punctuation">=</span>keys</span> 
Mode of operation<span class="token punctuation">:</span> create active keys and certificates<span class="token punctuation">.</span>
Enter PEM pass phrase<span class="token punctuation">:</span>
Creating active private key in directory keys<span class="token punctuation">.</span>
Creating active certificate in directory keys<span class="token punctuation">.</span>
Creating active private key in directory keys<span class="token punctuation">.</span>
Creating active certificate in directory keys<span class="token punctuation">.</span>
Creating active private key in directory keys<span class="token punctuation">.</span>
Creating active certificate in directory keys<span class="token punctuation">.</span>
Read 5 nodes from custer configuration<span class="token punctuation">.</span>
Found 5 nodes configured to run on this host<span class="token punctuation">.</span>
Created 3 keys and 3 certificates<span class="token punctuation">.</span>
$&gt;</code></pre>
  </div>
  <p>
   <code class="option">
    --create-key
   </code>
   causes
   <a class="link" href="mysql-cluster-programs-ndb-sign-keys.html" title="25.5.28 ndb_sign_keys — Create, Sign, and Manage TLS Keys and Certificates for NDB Cluster">
    <span class="command">
     <strong>
      ndb_sign_keys
     </strong>
    </span>
   </a>
   to connect to the management
        server, read the cluster configuration, and then create a full
        set of keys and certificates for all NDB nodes configured to run
        on the local host. The cluster management server must be running
        for this to work. If the management server is not running,
        ndb_sign_keys can read the cluster configuration file directly
        using the
   <a class="link" href="mysql-cluster-programs-ndb-sign-keys.html#option_ndb_sign_keys_config-file">
    <code class="option">
     --config-file
    </code>
   </a>
   option.
   <a class="link" href="mysql-cluster-programs-ndb-sign-keys.html" title="25.5.28 ndb_sign_keys — Create, Sign, and Manage TLS Keys and Certificates for NDB Cluster">
    <span class="command">
     <strong>
      ndb_sign_keys
     </strong>
    </span>
   </a>
   can also create a
        single key-certificate pair for a single node type using
   <a class="link" href="mysql-cluster-programs-ndb-sign-keys.html#option_ndb_sign_keys_no-config">
    <code class="option">
     --no-config
    </code>
   </a>
   to ignore the
        cluster configuration and
   <a class="link" href="mysql-cluster-programs-ndb-sign-keys.html#option_ndb_sign_keys_node-type">
    <code class="option">
     --node-type
    </code>
   </a>
   to specify the
        node type (one of
   <code class="literal">
    mgmd
   </code>
   ,
   <code class="literal">
    db
   </code>
   , or
   <code class="literal">
    api
   </code>
   ). In addition,
        you must either specify a hostname for the certificate with
   <a class="link" href="mysql-cluster-programs-ndb-sign-keys.html#option_ndb_sign_keys_bound-hostname">
    <code class="option">
     --bound-hostname=
     <em class="replaceable">
      <code>
       host_name
      </code>
     </em>
    </code>
   </a>
   ,
        or disable hostname binding by supplying
   <a class="link" href="mysql-cluster-programs-ndb-sign-keys.html#option_ndb_sign_keys_bind-host">
    <code class="option">
     --bind-host=0
    </code>
   </a>
   .
  </p>
  <p>
   Key signing by a remote host is accomplished by connecting to
        the CA host using
   <span class="command">
    <strong>
     ssh
    </strong>
   </span>
   .
  </p>
 </div>
 <br/>
</div>
