
Please not that OpenSSL is no longer enabled by default so you have to
rebuild the package yourself to get it work. See changelog.Debian entry
from 2004-12-02 for reasons.
Even now MySQL uses YaSSL which is GPLed instead of OpenSSL, the problem
persists: It would not be allowed to link LGPLed or other software like PHP
to a software that uses GPLed code.

The following text is a mini guide howto setup basic encrypted mysql service
once you build MySQL yourself using "--with-yassl/--with-openssl" in
debian/rules. The howto is probably outdated by now so see the MySQL
documentation on www.mysql.com for more information. There is no Debian support
for this!

<ch@debian.org>

--------------------------------------------------------------------------

0. Change to the mysql ssl directory
	cd /etc/mysql/ssl/

#
# Setup your own Certification Authority
#
1. Create your own Certification Authority (CA) if you do not already have
   one (e.g. for signing web or mail server certificates)
	openssl req -x509 -new -days 9999 -newkey rsa:2048 -nodes \
	   -keyout ca-key.pem \
	   -out ca-cert.pem
	
#
# Create a server certificate
#
	   
2a. Create the server certificate request
	openssl req -new -newkey rsa:2048 -nodes \
	  -keyout server-key.pem \
	  -out server-csr.pem 

2b. Sign this server request with the CA key to make a proper server certificate.
	openssl x509 -req -days 9999 \
	  -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -CAserial ca-srl.txt \
	  -in server-csr.pem \
	  -out server-cert.pem

2b. Adjust the following lines in /etc/mysql/my.cnf according to your needs:
	[mysqld]
	ssl-key=/etc/mysql/ssl/server-key.pem
	ssl-cert=/etc/mysql/ssl/server-cert.pem
	ssl-ca=/etc/mysql/ssl/ca-cert.pem


#
# Create the client certificates
# 
3a. Create the client certificate request
	openssl req -new -newkey rsa:2048 -nodes \
	  -keyout client-key.pem \
	  -out client-csr.pem 

3b. Sign this server request with the CA key to make a proper server certificate.
	openssl x509 -req -days 9999 \
	  -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -CAserial ca-srl.txt \
	  -in client-csr.pem \
	  -out client-cert.pem
	
3c. Now move the client* files to the client machine and adjust the users ~/.my.cnf
    or client hosts /etc/mysql/my.cnf:
	[client]
	ssl-key=/home/ch/client-key.pem
	ssl-cert=/home/ch/client-cert.pem

#
# Now configure SSL login constrains.
# 
4.a This allowes passwordless login if the cryptographic key, the client 
    ("subject") uses, was certified by our CA ("issuer") to belong to 
    the user it claims to.
    Don't be so lazy to just limit to a subject because without checking
    the issuer - whom's key only we have - anybody could fake the subject
    line rendering the whole thing nearly useless.
    	GRANT all 
	ON *.* 
	TO "my"
	REQUIRE
	  subject "/C=DE/ST=NRW/L=Aachen/CN=Foo Bar/emailAddress=foobar@example.com" and 
	  issuer "/C=DE/ST=NRW/L=Aachen/CN=Christian Hammers/emailAddress=ch@debian.org";

4.b Don't forget this one:
	FLUSH PRIVILEGES;
