Creating SSL and RSA Certificates and Keys Important Note There are easier alternatives to generating the files required for SSL than the procedure described here: Let the server autogenerate them or use the mysql_ssl_rsa_setup  program. See Section 6.3.3.1, “Creating SSL and RSA Certificates and Keys using MySQL” . Whatever method you use to generate the certificate and key files, the Common Name value used for the server and client certificates/keys must each differ from the Common Name value used for the CA certificate. Otherwise, the certificate and key files do not work for servers compiled using OpenSSL. A typical error in this case is: ERROR 2026 (HY000): SSL connection error: error:00000001:lib(0):func(0):reason(1) •Example 1: Creating SSL Files from the Command Line on Unix •Example 2: Creating SSL Files Using a Script on Unix •Example 3: Creating SSL Files on Windows Example 1: Creating SSL Files from the Command Line on Unix The following example shows a set of commands to create MySQL server and client certificate and key files. You must respond to several prompts by the  openssl  commands. To generate test files, you can press Enter to all prompts. To generate files for production use, you should provide nonempty responses. # Create clean environment rm -rf newcerts mkdir newcerts && cd newcerts # Create CA certificate openssl genrsa 2048 > ca-key.pem openssl req -new -x509 -nodes -days 3600 \ -key ca-key.pem -out ca.pem # Create server certificate, remove passphrase, and sign it # server-cert.pem = public key, server-key.pem = private key openssl req -newkey rsa:2048 -days 3600 \ -nodes -keyout server-key.pem -out server-req.pem openssl rsa -in server-key.pem -out server-key.pem openssl x509 -req -in server-req.pem -days 3600 \ -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem # Create client certificate, remove passphrase, and sign it # client-cert.pem = public key, client-key.pem = private key openssl req -newkey rsa:2048 -days 3600 \ -nodes -keyout client-key.pem -out client-req.pem openssl rsa -in client-key.pem -out client-key.pem openssl x509 -req -in client-req.pem -days 3600 \ -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out client-cert.pem openssl verify -CAfile ca.pem server-cert.pem client-cert.pem After generating the certificates, verify them: You should see a response like this: server-cert.pem: OK client-cert.pem: OK 1299