<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="creating-ssl-files-using-openssl">
      </a>
      8.3.3.2 Creating SSL Certificates and Keys Using openssl
     </h4>
    </div>
   </div>
  </div>
  <p>
   This section describes how to use the
   <span class="command">
    <strong>
     openssl
    </strong>
   </span>
   command to set up SSL certificate and key files for use by MySQL
        servers and clients. The first example shows a simplified
        procedure such as you might use from the command line. The
        second shows a script that contains more detail. The first two
        examples are intended for use on Unix and both use the
   <span class="command">
    <strong>
     openssl
    </strong>
   </span>
   command that is part of OpenSSL. The
        third example describes how to set up SSL files on Windows.
  </p>
  <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Note
   </div>
   <p>
    An easier alternative to generating the files required for SSL
          than the procedure described here is to let the server
          autogenerate them; see
    <a class="xref" href="creating-ssl-rsa-files-using-mysql.html" title="8.3.3.1 Creating SSL and RSA Certificates and Keys using MySQL">
     Section 8.3.3.1, “Creating SSL and RSA Certificates and Keys using MySQL”
    </a>
    .
   </p>
  </div>
  <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Important
   </div>
   <p>
    Whatever method you use to generate the certificate and key
          files, the Common Name value used for the server and client
          certificates/keys must each differ from the Common Name value
          used for the CA certificate. Otherwise, the certificate and
          key files do not work for servers compiled using OpenSSL. A
          typical error in this case is:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa63122740"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini">ERROR 2026 (HY000): SSL connection error:
error:00000001:lib(0):func(0):reason(1)</code></pre>
   </div>
  </div>
  <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Important
   </div>
   <p>
    If a client connecting to a MySQL server instance uses an SSL
          certificate with the
    <code class="literal">
     extendedKeyUsage
    </code>
    extension (an X.509 v3 extension), the extended key usage must
          include client authentication (
    <code class="literal">
     clientAuth
    </code>
    ).
          If the SSL certificate is only specified for server
          authentication (
    <code class="literal">
     serverAuth
    </code>
    ) and other
          non-client certificate purposes, certificate verification
          fails and the client connection to the MySQL server instance
          fails. There is no
    <code class="literal">
     extendedKeyUsage
    </code>
    extension in SSL certificates created using the
    <span class="command">
     <strong>
      openssl
     </strong>
    </span>
    command following the instructions
          in this topic. If you use your own client certificate created
          in another way, ensure any
    <code class="literal">
     extendedKeyUsage
    </code>
    extension includes client authentication.
   </p>
  </div>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="creating-ssl-files-using-openssl.html#creating-ssl-files-using-openssl-unix-command-line" title="Example 1: Creating SSL Files from the Command Line on Unix">
       Example 1: Creating SSL Files from the Command Line on Unix
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="creating-ssl-files-using-openssl.html#creating-ssl-files-using-openssl-unix-script" title="Example 2: Creating SSL Files Using a Script on Unix">
       Example 2: Creating SSL Files Using a Script on Unix
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="creating-ssl-files-using-openssl.html#creating-ssl-files-using-openssl-windows" title="Example 3: Creating SSL Files on Windows">
       Example 3: Creating SSL Files on Windows
      </a>
     </p>
    </li>
   </ul>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="creating-ssl-files-using-openssl-unix-command-line">
       </a>
       Example 1: Creating SSL Files from the Command Line on Unix
      </h5>
     </div>
    </div>
   </div>
   <p>
    The following example shows a set of commands to create MySQL
          server and client certificate and key files. You must respond
          to several prompts by the
    <span class="command">
     <strong>
      openssl
     </strong>
    </span>
    commands.
          To generate test files, you can press Enter to all prompts. To
          generate files for production use, you should provide nonempty
          responses.
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa6459790"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token comment" spellcheck="true"># Create clean environment</span>
rm <span class="token property">-rf</span> newcerts
mkdir newcerts &amp;&amp; cd newcerts

<span class="token comment" spellcheck="true"># Create CA certificate</span>
openssl genrsa 2048 &gt; ca-key<span class="token punctuation">.</span>pem
openssl req <span class="token property">-new</span> <span class="token property">-x509</span> <span class="token property">-nodes</span> <span class="token property">-days</span> 3600 \
        <span class="token property">-key</span> ca-key<span class="token punctuation">.</span>pem <span class="token property">-out</span> ca<span class="token punctuation">.</span>pem

<span class="token comment" spellcheck="true"># Create server certificate, remove passphrase, and sign it</span>
<span class="token comment" spellcheck="true"># server-cert.pem = public key, server-key.pem = private key</span>
openssl req <span class="token property">-newkey</span> rsa<span class="token punctuation">:</span>2048 <span class="token property">-days</span> 3600 \
        <span class="token property">-nodes</span> <span class="token property">-keyout</span> server-key<span class="token punctuation">.</span>pem <span class="token property">-out</span> server-req<span class="token punctuation">.</span>pem
openssl rsa <span class="token property">-in</span> server-key<span class="token punctuation">.</span>pem <span class="token property">-out</span> server-key<span class="token punctuation">.</span>pem
openssl x509 <span class="token property">-req</span> <span class="token property">-in</span> server-req<span class="token punctuation">.</span>pem <span class="token property">-days</span> 3600 \
        <span class="token property">-CA</span> ca<span class="token punctuation">.</span>pem <span class="token property">-CAkey</span> ca-key<span class="token punctuation">.</span>pem <span class="token property">-set_serial</span> 01 <span class="token property">-out</span> server-cert<span class="token punctuation">.</span>pem

<span class="token comment" spellcheck="true"># Create client certificate, remove passphrase, and sign it</span>
<span class="token comment" spellcheck="true"># client-cert.pem = public key, client-key.pem = private key</span>
openssl req <span class="token property">-newkey</span> rsa<span class="token punctuation">:</span>2048 <span class="token property">-days</span> 3600 \
        <span class="token property">-nodes</span> <span class="token property">-keyout</span> client-key<span class="token punctuation">.</span>pem <span class="token property">-out</span> client-req<span class="token punctuation">.</span>pem
openssl rsa <span class="token property">-in</span> client-key<span class="token punctuation">.</span>pem <span class="token property">-out</span> client-key<span class="token punctuation">.</span>pem
openssl x509 <span class="token property">-req</span> <span class="token property">-in</span> client-req<span class="token punctuation">.</span>pem <span class="token property">-days</span> 3600 \
        <span class="token property">-CA</span> ca<span class="token punctuation">.</span>pem <span class="token property">-CAkey</span> ca-key<span class="token punctuation">.</span>pem <span class="token property">-set_serial</span> 01 <span class="token property">-out</span> client-cert<span class="token punctuation">.</span>pem</code></pre>
   </div>
   <p>
    After generating the certificates, verify them:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa6395086"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">openssl verify <span class="token property">-CAfile</span> ca<span class="token punctuation">.</span>pem server-cert<span class="token punctuation">.</span>pem client-cert<span class="token punctuation">.</span>pem</code></pre>
   </div>
   <p>
    You should see a response like this:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa95197928"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini">server-cert.pem: OK
client-cert.pem: OK</code></pre>
   </div>
   <p>
    To see the contents of a certificate (for example, to check
          the range of dates over which a certificate is valid), invoke
    <span class="command">
     <strong>
      openssl
     </strong>
    </span>
    like this:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa82776859"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">openssl x509 <span class="token property">-text</span> <span class="token property">-in</span> ca<span class="token punctuation">.</span>pem
openssl x509 <span class="token property">-text</span> <span class="token property">-in</span> server-cert<span class="token punctuation">.</span>pem
openssl x509 <span class="token property">-text</span> <span class="token property">-in</span> client-cert<span class="token punctuation">.</span>pem</code></pre>
   </div>
   <p>
    Now you have a set of files that can be used as follows:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="filename">
        ca.pem
       </code>
       : Use this to set the
       <a class="link" href="server-system-variables.html#sysvar_ssl_ca">
        <code class="literal">
         ssl_ca
        </code>
       </a>
       system variable on
              the server side and the
       <a class="link" href="connection-options.html#option_general_ssl-ca">
        <code class="option">
         --ssl-ca
        </code>
       </a>
       option on the
              client side. (The CA certificate, if used, must be the
              same on both sides.)
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="filename">
        server-cert.pem
       </code>
       ,
       <code class="filename">
        server-key.pem
       </code>
       : Use these to set the
       <a class="link" href="server-system-variables.html#sysvar_ssl_cert">
        <code class="literal">
         ssl_cert
        </code>
       </a>
       and
       <a class="link" href="server-system-variables.html#sysvar_ssl_key">
        <code class="literal">
         ssl_key
        </code>
       </a>
       system variables
              on the server side.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="filename">
        client-cert.pem
       </code>
       ,
       <code class="filename">
        client-key.pem
       </code>
       : Use these as the
              arguments to the
       <a class="link" href="connection-options.html#option_general_ssl-cert">
        <code class="option">
         --ssl-cert
        </code>
       </a>
       and
       <a class="link" href="connection-options.html#option_general_ssl-key">
        <code class="option">
         --ssl-key
        </code>
       </a>
       options on the
              client side.
      </p>
     </li>
    </ul>
   </div>
   <p>
    For additional usage instructions, see
    <a class="xref" href="using-encrypted-connections.html" title="8.3.1 Configuring MySQL to Use Encrypted Connections">
     Section 8.3.1, “Configuring MySQL to Use Encrypted Connections”
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="creating-ssl-files-using-openssl-unix-script">
       </a>
       Example 2: Creating SSL Files Using a Script on Unix
      </h5>
     </div>
    </div>
   </div>
   <p>
    Here is an example script that shows how to set up SSL
          certificate and key files for MySQL. After executing the
          script, use the files for SSL connections as described in
    <a class="xref" href="using-encrypted-connections.html" title="8.3.1 Configuring MySQL to Use Encrypted Connections">
     Section 8.3.1, “Configuring MySQL to Use Encrypted Connections”
    </a>
    .
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa66149182"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">DIR<span class="token attr-value"><span class="token punctuation">=</span>`pwd`/openssl</span>
PRIV<span class="token attr-value"><span class="token punctuation">=</span>$DIR/private</span>

mkdir $DIR $PRIV $DIR/newcerts
cp /usr/share/ssl/openssl<span class="token punctuation">.</span>cnf $DIR
replace <span class="token punctuation">.</span>/demoCA $DIR <span class="token property">--</span> $DIR/openssl<span class="token punctuation">.</span>cnf

<span class="token comment" spellcheck="true"># Create necessary files: $database, $serial and $new_certs_dir</span>
<span class="token comment" spellcheck="true"># directory (optional)</span>

touch $DIR/index<span class="token punctuation">.</span>txt
echo <span class="token atrule">"01"</span> &gt; $DIR/serial

<span class="token comment" spellcheck="true">#</span>
<span class="token comment" spellcheck="true"># Generation of Certificate Authority(CA)</span>
<span class="token comment" spellcheck="true">#</span>

openssl req <span class="token property">-new</span> <span class="token property">-x509</span> <span class="token property">-keyout</span> $PRIV/cakey<span class="token punctuation">.</span>pem <span class="token property">-out</span> $DIR/ca<span class="token punctuation">.</span>pem \
    <span class="token property">-days</span> 3600 <span class="token property">-config</span> $DIR/openssl<span class="token punctuation">.</span>cnf

<span class="token comment" spellcheck="true"># Sample output:</span>
<span class="token comment" spellcheck="true"># Using configuration from /home/jones/openssl/openssl.cnf</span>
<span class="token comment" spellcheck="true"># Generating a 1024 bit RSA private key</span>
<span class="token comment" spellcheck="true"># ................++++++</span>
<span class="token comment" spellcheck="true"># .........++++++</span>
<span class="token comment" spellcheck="true"># writing new private key to '/home/jones/openssl/private/cakey.pem'</span>
<span class="token comment" spellcheck="true"># Enter PEM pass phrase:</span>
<span class="token comment" spellcheck="true"># Verifying password - Enter PEM pass phrase:</span>
<span class="token comment" spellcheck="true"># -----</span>
<span class="token comment" spellcheck="true"># You are about to be asked to enter information to be</span>
<span class="token comment" spellcheck="true"># incorporated into your certificate request.</span>
<span class="token comment" spellcheck="true"># What you are about to enter is what is called a Distinguished Name</span>
<span class="token comment" spellcheck="true"># or a DN.</span>
<span class="token comment" spellcheck="true"># There are quite a few fields but you can leave some blank</span>
<span class="token comment" spellcheck="true"># For some fields there will be a default value,</span>
<span class="token comment" spellcheck="true"># If you enter '.', the field will be left blank.</span>
<span class="token comment" spellcheck="true"># -----</span>
<span class="token comment" spellcheck="true"># Country Name (2 letter code) [AU]:FI</span>
<span class="token comment" spellcheck="true"># State or Province Name (full name) [Some-State]:.</span>
<span class="token comment" spellcheck="true"># Locality Name (eg, city) []:</span>
<span class="token comment" spellcheck="true"># Organization Name (eg, company) [Internet Widgits Pty Ltd]:MySQL AB</span>
<span class="token comment" spellcheck="true"># Organizational Unit Name (eg, section) []:</span>
<span class="token comment" spellcheck="true"># Common Name (eg, YOUR name) []:MySQL admin</span>
<span class="token comment" spellcheck="true"># Email Address []:</span>

<span class="token comment" spellcheck="true">#</span>
<span class="token comment" spellcheck="true"># Create server request and key</span>
<span class="token comment" spellcheck="true">#</span>
openssl req <span class="token property">-new</span> <span class="token property">-keyout</span> $DIR/server-key<span class="token punctuation">.</span>pem <span class="token property">-out</span> \
    $DIR/server-req<span class="token punctuation">.</span>pem <span class="token property">-days</span> 3600 <span class="token property">-config</span> $DIR/openssl<span class="token punctuation">.</span>cnf

<span class="token comment" spellcheck="true"># Sample output:</span>
<span class="token comment" spellcheck="true"># Using configuration from /home/jones/openssl/openssl.cnf</span>
<span class="token comment" spellcheck="true"># Generating a 1024 bit RSA private key</span>
<span class="token comment" spellcheck="true"># ..++++++</span>
<span class="token comment" spellcheck="true"># ..........++++++</span>
<span class="token comment" spellcheck="true"># writing new private key to '/home/jones/openssl/server-key.pem'</span>
<span class="token comment" spellcheck="true"># Enter PEM pass phrase:</span>
<span class="token comment" spellcheck="true"># Verifying password - Enter PEM pass phrase:</span>
<span class="token comment" spellcheck="true"># -----</span>
<span class="token comment" spellcheck="true"># You are about to be asked to enter information that will be</span>
<span class="token comment" spellcheck="true"># incorporated into your certificate request.</span>
<span class="token comment" spellcheck="true"># What you are about to enter is what is called a Distinguished Name</span>
<span class="token comment" spellcheck="true"># or a DN.</span>
<span class="token comment" spellcheck="true"># There are quite a few fields but you can leave some blank</span>
<span class="token comment" spellcheck="true"># For some fields there will be a default value,</span>
<span class="token comment" spellcheck="true"># If you enter '.', the field will be left blank.</span>
<span class="token comment" spellcheck="true"># -----</span>
<span class="token comment" spellcheck="true"># Country Name (2 letter code) [AU]:FI</span>
<span class="token comment" spellcheck="true"># State or Province Name (full name) [Some-State]:.</span>
<span class="token comment" spellcheck="true"># Locality Name (eg, city) []:</span>
<span class="token comment" spellcheck="true"># Organization Name (eg, company) [Internet Widgits Pty Ltd]:MySQL AB</span>
<span class="token comment" spellcheck="true"># Organizational Unit Name (eg, section) []:</span>
<span class="token comment" spellcheck="true"># Common Name (eg, YOUR name) []:MySQL server</span>
<span class="token comment" spellcheck="true"># Email Address []:</span>
<span class="token comment" spellcheck="true">#</span>
<span class="token comment" spellcheck="true"># Please enter the following 'extra' attributes</span>
<span class="token comment" spellcheck="true"># to be sent with your certificate request</span>
<span class="token comment" spellcheck="true"># A challenge password []:</span>
<span class="token comment" spellcheck="true"># An optional company name []:</span>

<span class="token comment" spellcheck="true">#</span>
<span class="token comment" spellcheck="true"># Remove the passphrase from the key</span>
<span class="token comment" spellcheck="true">#</span>
openssl rsa <span class="token property">-in</span> $DIR/server-key<span class="token punctuation">.</span>pem <span class="token property">-out</span> $DIR/server-key<span class="token punctuation">.</span>pem

<span class="token comment" spellcheck="true">#</span>
<span class="token comment" spellcheck="true"># Sign server cert</span>
<span class="token comment" spellcheck="true">#</span>
openssl ca <span class="token property">-cert</span> $DIR/ca<span class="token punctuation">.</span>pem <span class="token property">-policy</span> policy_anything \
    <span class="token property">-out</span> $DIR/server-cert<span class="token punctuation">.</span>pem <span class="token property">-config</span> $DIR/openssl<span class="token punctuation">.</span>cnf \
    <span class="token property">-infiles</span> $DIR/server-req<span class="token punctuation">.</span>pem

<span class="token comment" spellcheck="true"># Sample output:</span>
<span class="token comment" spellcheck="true"># Using configuration from /home/jones/openssl/openssl.cnf</span>
<span class="token comment" spellcheck="true"># Enter PEM pass phrase:</span>
<span class="token comment" spellcheck="true"># Check that the request matches the signature</span>
<span class="token comment" spellcheck="true"># Signature ok</span>
<span class="token comment" spellcheck="true"># The Subjects Distinguished Name is as follows</span>
<span class="token comment" spellcheck="true"># countryName           :PRINTABLE:'FI'</span>
<span class="token comment" spellcheck="true"># organizationName      :PRINTABLE:'MySQL AB'</span>
<span class="token comment" spellcheck="true"># commonName            :PRINTABLE:'MySQL admin'</span>
<span class="token comment" spellcheck="true"># Certificate is to be certified until Sep 13 14:22:46 2003 GMT</span>
<span class="token comment" spellcheck="true"># (365 days)</span>
<span class="token comment" spellcheck="true"># Sign the certificate? [y/n]:y</span>
<span class="token comment" spellcheck="true">#</span>
<span class="token comment" spellcheck="true">#</span>
<span class="token comment" spellcheck="true"># 1 out of 1 certificate requests certified, commit? [y/n]y</span>
<span class="token comment" spellcheck="true"># Write out database with 1 new entries</span>
<span class="token comment" spellcheck="true"># Data Base Updated</span>

<span class="token comment" spellcheck="true">#</span>
<span class="token comment" spellcheck="true"># Create client request and key</span>
<span class="token comment" spellcheck="true">#</span>
openssl req <span class="token property">-new</span> <span class="token property">-keyout</span> $DIR/client-key<span class="token punctuation">.</span>pem <span class="token property">-out</span> \
    $DIR/client-req<span class="token punctuation">.</span>pem <span class="token property">-days</span> 3600 <span class="token property">-config</span> $DIR/openssl<span class="token punctuation">.</span>cnf

<span class="token comment" spellcheck="true"># Sample output:</span>
<span class="token comment" spellcheck="true"># Using configuration from /home/jones/openssl/openssl.cnf</span>
<span class="token comment" spellcheck="true"># Generating a 1024 bit RSA private key</span>
<span class="token comment" spellcheck="true"># .....................................++++++</span>
<span class="token comment" spellcheck="true"># .............................................++++++</span>
<span class="token comment" spellcheck="true"># writing new private key to '/home/jones/openssl/client-key.pem'</span>
<span class="token comment" spellcheck="true"># Enter PEM pass phrase:</span>
<span class="token comment" spellcheck="true"># Verifying password - Enter PEM pass phrase:</span>
<span class="token comment" spellcheck="true"># -----</span>
<span class="token comment" spellcheck="true"># You are about to be asked to enter information that will be</span>
<span class="token comment" spellcheck="true"># incorporated into your certificate request.</span>
<span class="token comment" spellcheck="true"># What you are about to enter is what is called a Distinguished Name</span>
<span class="token comment" spellcheck="true"># or a DN.</span>
<span class="token comment" spellcheck="true"># There are quite a few fields but you can leave some blank</span>
<span class="token comment" spellcheck="true"># For some fields there will be a default value,</span>
<span class="token comment" spellcheck="true"># If you enter '.', the field will be left blank.</span>
<span class="token comment" spellcheck="true"># -----</span>
<span class="token comment" spellcheck="true"># Country Name (2 letter code) [AU]:FI</span>
<span class="token comment" spellcheck="true"># State or Province Name (full name) [Some-State]:.</span>
<span class="token comment" spellcheck="true"># Locality Name (eg, city) []:</span>
<span class="token comment" spellcheck="true"># Organization Name (eg, company) [Internet Widgits Pty Ltd]:MySQL AB</span>
<span class="token comment" spellcheck="true"># Organizational Unit Name (eg, section) []:</span>
<span class="token comment" spellcheck="true"># Common Name (eg, YOUR name) []:MySQL user</span>
<span class="token comment" spellcheck="true"># Email Address []:</span>
<span class="token comment" spellcheck="true">#</span>
<span class="token comment" spellcheck="true"># Please enter the following 'extra' attributes</span>
<span class="token comment" spellcheck="true"># to be sent with your certificate request</span>
<span class="token comment" spellcheck="true"># A challenge password []:</span>
<span class="token comment" spellcheck="true"># An optional company name []:</span>

<span class="token comment" spellcheck="true">#</span>
<span class="token comment" spellcheck="true"># Remove the passphrase from the key</span>
<span class="token comment" spellcheck="true">#</span>
openssl rsa <span class="token property">-in</span> $DIR/client-key<span class="token punctuation">.</span>pem <span class="token property">-out</span> $DIR/client-key<span class="token punctuation">.</span>pem

<span class="token comment" spellcheck="true">#</span>
<span class="token comment" spellcheck="true"># Sign client cert</span>
<span class="token comment" spellcheck="true">#</span>

openssl ca <span class="token property">-cert</span> $DIR/ca<span class="token punctuation">.</span>pem <span class="token property">-policy</span> policy_anything \
    <span class="token property">-out</span> $DIR/client-cert<span class="token punctuation">.</span>pem <span class="token property">-config</span> $DIR/openssl<span class="token punctuation">.</span>cnf \
    <span class="token property">-infiles</span> $DIR/client-req<span class="token punctuation">.</span>pem

<span class="token comment" spellcheck="true"># Sample output:</span>
<span class="token comment" spellcheck="true"># Using configuration from /home/jones/openssl/openssl.cnf</span>
<span class="token comment" spellcheck="true"># Enter PEM pass phrase:</span>
<span class="token comment" spellcheck="true"># Check that the request matches the signature</span>
<span class="token comment" spellcheck="true"># Signature ok</span>
<span class="token comment" spellcheck="true"># The Subjects Distinguished Name is as follows</span>
<span class="token comment" spellcheck="true"># countryName           :PRINTABLE:'FI'</span>
<span class="token comment" spellcheck="true"># organizationName      :PRINTABLE:'MySQL AB'</span>
<span class="token comment" spellcheck="true"># commonName            :PRINTABLE:'MySQL user'</span>
<span class="token comment" spellcheck="true"># Certificate is to be certified until Sep 13 16:45:17 2003 GMT</span>
<span class="token comment" spellcheck="true"># (365 days)</span>
<span class="token comment" spellcheck="true"># Sign the certificate? [y/n]:y</span>
<span class="token comment" spellcheck="true">#</span>
<span class="token comment" spellcheck="true">#</span>
<span class="token comment" spellcheck="true"># 1 out of 1 certificate requests certified, commit? [y/n]y</span>
<span class="token comment" spellcheck="true"># Write out database with 1 new entries</span>
<span class="token comment" spellcheck="true"># Data Base Updated</span>

<span class="token comment" spellcheck="true">#</span>
<span class="token comment" spellcheck="true"># Create a my.cnf file that you can use to test the certificates</span>
<span class="token comment" spellcheck="true">#</span>

cat &lt;&lt;EOF &gt; $DIR/my<span class="token punctuation">.</span>cnf
<span class="token punctuation">[</span>client<span class="token punctuation">]</span>
ssl<span class="token constant">-ca</span><span class="token attr-value"><span class="token punctuation">=</span>$DIR/ca.pem</span>
ssl<span class="token constant">-cert</span><span class="token attr-value"><span class="token punctuation">=</span>$DIR/client-cert.pem</span>
ssl<span class="token constant">-key</span><span class="token attr-value"><span class="token punctuation">=</span>$DIR/client-key.pem</span>
<span class="token punctuation">[</span>mysqld<span class="token punctuation">]</span>
ssl_ca<span class="token attr-value"><span class="token punctuation">=</span>$DIR/ca.pem</span>
ssl_cert<span class="token attr-value"><span class="token punctuation">=</span>$DIR/server-cert.pem</span>
ssl_key<span class="token attr-value"><span class="token punctuation">=</span>$DIR/server-key.pem</span>
EOF</code></pre>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="creating-ssl-files-using-openssl-windows">
       </a>
       Example 3: Creating SSL Files on Windows
      </h5>
     </div>
    </div>
   </div>
   <p>
    Download OpenSSL for Windows if it is not installed on your
          system. An overview of available packages can be seen here:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-ini"><div class="docs-select-all right" id="sa18995837"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini">http://www.slproweb.com/products/Win32OpenSSL.html</code></pre>
   </div>
   <p>
    Choose the Win32 OpenSSL Light or Win64 OpenSSL Light package,
          depending on your architecture (32-bit or 64-bit). The default
          installation location is
    <code class="literal">
     C:\OpenSSL-Win32
    </code>
    or
    <code class="literal">
     C:\OpenSSL-Win64
    </code>
    , depending on which
          package you downloaded. The following instructions assume a
          default location of
    <code class="literal">
     C:\OpenSSL-Win32
    </code>
    .
          Modify this as necessary if you are using the 64-bit package.
   </p>
   <p>
    If a message occurs during setup indicating
    <code class="literal">
     '...critical component is missing: Microsoft Visual
          C++ 2019 Redistributables'
    </code>
    , cancel the setup and
          download one of the following packages as well, again
          depending on your architecture (32-bit or 64-bit):
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Visual C++ 2008 Redistributables (x86), available at:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-ini"><div class="docs-select-all right" id="sa79668335"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token constant">http://www.microsoft.com/downloads/details.aspx?familyid</span><span class="token attr-value"><span class="token punctuation">=</span>9B2DA534-3E03-4391-8A4D-074B9F2BC1BF</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       Visual C++ 2008 Redistributables (x64), available at:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting one-line language-ini"><div class="docs-select-all right" id="sa99928952"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token constant">http://www.microsoft.com/downloads/details.aspx?familyid</span><span class="token attr-value"><span class="token punctuation">=</span>bd2a6171-e2d6-4230-b809-9a8d7548c1b6</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    After installing the additional package, restart the OpenSSL
          setup procedure.
   </p>
   <p>
    During installation, leave the default
    <code class="filename">
     C:\OpenSSL-Win32
    </code>
    as the install path, and
          also leave the default option
    <code class="literal">
     'Copy OpenSSL DLL files
          to the Windows system directory'
    </code>
    selected.
   </p>
   <p>
    When the installation has finished, add
    <code class="filename">
     C:\OpenSSL-Win32\bin
    </code>
    to the Windows
          System Path variable of your server (depending on your version
          of Windows, the following path-setting instructions might
          differ slightly):
   </p>
   <div class="orderedlist">
    <ol class="orderedlist" type="1">
     <li class="listitem">
      <p>
       On the Windows desktop, right-click the
       <span class="guiicon">
        My
              Computer
       </span>
       icon, and select
       <span class="guimenuitem">
        Properties
       </span>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       Select the
       <span class="guimenuitem">
        Advanced
       </span>
       tab from
              the
       <span class="guimenu">
        System Properties
       </span>
       menu that
              appears, and click the
       <span class="guibutton">
        Environment
              Variables
       </span>
       button.
      </p>
     </li>
     <li class="listitem">
      <p>
       Under
       <span class="guilabel">
        System Variables
       </span>
       , select
       <span class="guimenuitem">
        Path
       </span>
       , then click the
       <span class="guibutton">
        Edit
       </span>
       button. The
       <span class="guimenu">
        Edit
              System Variable
       </span>
       dialogue should appear.
      </p>
     </li>
     <li class="listitem">
      <p>
       Add
       <code class="literal">
        ';C:\OpenSSL-Win32\bin'
       </code>
       to the end
              (notice the semicolon).
      </p>
     </li>
     <li class="listitem">
      <p>
       Press OK 3 times.
      </p>
     </li>
     <li class="listitem">
      <p>
       Check that OpenSSL was correctly integrated into the Path
              variable by opening a new command console
              (
       <span class="command">
        <strong>
         Start&gt;Run&gt;cmd.exe
        </strong>
       </span>
       ) and verifying
              that OpenSSL is available:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa18764222"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">Microsoft Windows <span class="token punctuation">[</span>Version <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">]</span>
Copyright <span class="token punctuation">(</span>c<span class="token punctuation">)</span> 2006 Microsoft Corporation<span class="token punctuation">.</span> All rights reserved<span class="token punctuation">.</span>

<span class="token prompt">C:\Windows\system32&gt;</span><span class="token command">cd</span> \

<span class="token prompt">C:\&gt;</span><span class="token command">openssl</span>
OpenSSL&gt; exit &lt;&lt;&lt; If you see the OpenSSL prompt<span class="token punctuation">,</span> installation was successful<span class="token punctuation">.</span>

<span class="token prompt">C:\&gt;</span></code></pre>
      </div>
     </li>
    </ol>
   </div>
   <p>
    After OpenSSL has been installed, use instructions similar to
          those from Example 1 (shown earlier in this section), with the
          following changes:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Change the following Unix commands:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa64563745"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token comment" spellcheck="true"># Create clean environment</span>
rm <span class="token property">-rf</span> newcerts
mkdir newcerts &amp;&amp; cd newcerts</code></pre>
      </div>
      <p>
       On Windows, use these commands instead:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa12249083"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token comment" spellcheck="true"># Create clean environment</span>
md c<span class="token punctuation">:</span>\newcerts
cd c<span class="token punctuation">:</span>\newcerts</code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       When a
       <code class="literal">
        '\'
       </code>
       character is shown at the
              end of a command line, this
       <code class="literal">
        '\'
       </code>
       character must be removed and the command lines entered
              all on a single line.
      </p>
     </li>
    </ul>
   </div>
   <p>
    After generating the certificate and key files, to use them
          for SSL connections, see
    <a class="xref" href="using-encrypted-connections.html" title="8.3.1 Configuring MySQL to Use Encrypted Connections">
     Section 8.3.1, “Configuring MySQL to Use Encrypted Connections”
    </a>
    .
   </p>
  </div>
 </div>
 <br/>
</div>
