mysql_ssl_rsa_setup — Create SSL/RSA Files At startup, the MySQL server automatically uses the SSL files created by  mysql_ssl_rsa_setup  to enable SSL if no explicit SSL options are given other than  --ssl  (possibly along with  ssl_cipher ). If you prefer to designate the files explicitly, invoke clients with the  --ssl-ca ,  --ssl-cert , and  -- ssl-key  options at startup to name the  ca.pem ,  server-cert.pem , and  server-key.pem  files, respectively. The server also automatically uses the RSA files created by  mysql_ssl_rsa_setup  to enable RSA if no explicit RSA options are given. If the server is SSL-enabled, clients use SSL by default for the connection. To specify certificate and key files explicitly, use the  --ssl-ca ,  --ssl-cert , and  --ssl-key  options to name the  ca.pem ,  client- cert.pem , and  client-key.pem  files, respectively. However, some additional client setup may be required first because  mysql_ssl_rsa_setup  by default creates those files in the data directory. The permissions for the data directory normally enable access only to the system account that runs the MySQL server, so client programs cannot use files located there. To make the files available, copy them to a directory that is readable (but  not  writable) by clients: If the SSL files used for a MySQL installation have expired, you can use  mysql_ssl_rsa_setup  to create new ones: mysql_ssl_rsa_setup  supports the following command-line options, which can be specified on the command line or in the  [mysql_ssl_rsa_setup]  and  [mysqld]  groups of an option file. For information about option files used by MySQL programs, see Section 4.2.2.2, “Using Option Files” . Table 4.9 mysql_ssl_rsa_setup Options Option Name Description --datadir Path to data directory --help Display help message and exit --suffix Suffix for X.509 certificate Common Name attribute --uid Name of effective user to use for file permissions --verbose Verbose mode --version Display version information and exit Display a help message and exit. • --help ,  ? 402 4. Restart the server. 3. Run  mysql_ssl_rsa_setup  with the  --datadir  option to specify where to create the new files. 2. Rename or remove the existing SSL files. You may wish to make a backup of them first. (The RSA files do not expire, so you need not remove them.  mysql_ssl_rsa_setup  can see that they exist and does not overwrite them.) 1. Stop the server. •For remote clients, distribute the files using a secure channel to ensure they are not tampered with during transit. •For local clients, the MySQL installation directory can be used. For example, if the data directory is a subdirectory of the installation directory and your current location is the data directory, you can copy the files like this: cp ca.pem client-cert.pem client-key.pem ..