윈도우서버에서 OPENSSL을 이용해서 Certificate발행 MYSQL 적용

OPENSSL 을 다운로드 받는다.

폴더를 생성한다.

md foldername

명령어를 실행하여 openssl 커맨드를 사용할 수 있게 한다. 

set OPENSSL_CONF=c:\OpenSSL-Win64\bin\openssl.cfg

cmd 에서 아래 명령어를 하줄씩 처리한다.

# Create CA certificate

openssl genrsa 2048 > ca-key.pem

openssl req -new -x509 -nodes -days 3600 -key ca-key.pem -out ca.pem

# Create server certificate, remove passphrase, and sign it

# server-cert.pem = public key, server-key.pem = private key

openssl req -newkey rsa:2048 -days 3600  -nodes -keyout server-key.pem -out server-req.pem

openssl rsa -in server-key.pem -out server-key.pem

openssl x509 -req -in server-req.pem -days 3600 -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem

# Create client certificate, remove passphrase, and sign it

# client-cert.pem = public key, client-key.pem = private key

openssl req -newkey rsa:2048 -days 3600  -nodes -keyout client-key.pem -out client-req.pem

openssl rsa -in client-key.pem -out client-key.pem

openssl x509 -req -in client-req.pem -days 3600  -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out client-cert.pem

MYSQL INI 파일을연다.

Linux 는 my.cnf 윈도우는 my.ini

윈도우 경우 my.ini 경로는 C:\ProgramData\MySQL\MySQL Server 5.7\ (hidden 처리 되어있음으로 경로를 직접 쳐야함)

my.ini 에서 

[mysqld] 아래에

ssl-ca  = "C:\mysqlCerts\ca-cert.pem"

ssl-cert = "C:\mysqlCerts\\server-cert.pem"

ssl-key   = "C:\mysqlCerts\\server-key.pem"

(\\ 맞음)

Mysql TLS1.2 연결 문제 

https://dev.mysql.com/doc/refman/5.7/en/creating-ssl-files-using-openssl.html

https://serverfault.com/questions/783861/enabling-ssl-in-mysql-when-using-windows-as-a-server-and-client

https://blogs.perficient.com/microsoft/2016/04/tsl-1-2-and-net-support/

https://dev.mysql.com/doc/connector-net/en/connector-net-entityframework60.html

http://mysqlblog.fivefarmers.com/2015/12/10/ssltls-improvements-in-mysql-5-7-10/

https://bugs.mysql.com/bug.php?id=75239

Mysql 에 들어가서 

show global variables like '%ssl%';

variables name 과 value가 나오면 Have_openssl 과 have_ssl 에 YES가 나와야 정상임.

만약 웹사이트 connection 에러가 발생한다면 

(https://forums.iis.net/t/1233122.aspx)

1.Control Panel,--> Administrative Tools, -->Local Security Policy.

2. Local Security Settings, --> Local Policies -->Security Options.

3. Policye --> cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing -->Enabled.

4. gpupdate /force

이렇게 해도 안될경우  C:\ProgramData\Microsoft\Crypto\RSA 에서 grant "Network Services" Read permission 을 "MachineKeys" 

으로 변경

서버 리스타트.