Creating SSL and RSA Certificates and Keys To see the contents of a certificate (for example, to check the range of dates over which a certificate is valid), invoke  openssl  like this: Now you have a set of files that can be used as follows: For additional usage instructions, see Section 6.3.1, “Configuring MySQL to Use Encrypted Connections” . Here is an example script that shows how to set up SSL certificate and key files for MySQL. After executing the script, use the files for SSL connections as described in Section 6.3.1, “Configuring MySQL to Use Encrypted Connections” . 1300 DIR=‘pwd‘/openssl PRIV=$DIR/private mkdir $DIR $PRIV $DIR/newcerts cp /usr/share/ssl/openssl.cnf $DIR replace ./demoCA $DIR -- $DIR/openssl.cnf # Create necessary files: $database, $serial and $new_certs_dir # directory (optional) touch $DIR/index.txt echo "01" > $DIR/serial # # Generation of Certificate Authority(CA) # openssl req -new -x509 -keyout $PRIV/cakey.pem -out $DIR/ca.pem \ -days 3600 -config $DIR/openssl.cnf # Sample output: # Using configuration from /home/jones/openssl/openssl.cnf # Generating a 1024 bit RSA private key # ................++++++ # .........++++++ # writing new private key to ’/home/jones/openssl/private/cakey.pem’ # Enter PEM pass phrase: # Verifying password - Enter PEM pass phrase: # ----- # You are about to be asked to enter information to be # incorporated into your certificate request. # What you are about to enter is what is called a Distinguished Name # or a DN. # There are quite a few fields but you can leave some blank # For some fields there will be a default value, # If you enter ’.’, the field will be left blank. # ----- # Country Name (2 letter code) [AU]:FI # State or Province Name (full name) [Some-State]:. Example 2: Creating SSL Files Using a Script on Unix • client-cert.pem ,  client-key.pem : Use these as the arguments to the  --ssl-cert  and  --ssl- key  options on the client side. • server-cert.pem ,  server-key.pem : Use these to set the  ssl_cert  and  ssl_key  system variables on the server side. • ca.pem : Use this to set the  ssl_ca  system variable on the server side and the  --ssl-ca  option on the client side. (The CA certificate, if used, must be the same on both sides.) openssl x509 -text -in ca.pem openssl x509 -text -in server-cert.pem openssl x509 -text -in client-cert.pem