Mysql – Trying to understand MySQL Replication with SSL

MySQLmysql-5.5replicationssl

I'm trying to get my head around the use of SSL with MySQL replication.
I've spent all day reading blog posts / articles about this, and I'm still no closer to getting an answer to this question:

Essentially I'm trying to understand the relationship between the ca, client & server files.

In my fictional setup I have:

1 x Master DB - Main Site
5 x Slave DBs - Main Site
Each Slave DB connects to a Slave DB on a remote (all different) Customer Site.

Am I right in thinking therefore that I would:

  1. generate the ca-cert.pem and ca-key.pem files on the Master DB
  2. create a set of client-xxx and server-xxx files on each Slave DB (and a copy of the ca-xxx.pem files)
  3. Onto each Customer DB I would copy the ca-cert.pem,client-cert.pem,client-key.pem from the matching Slave DB

If one of the customer DB's was compromised would I need to generate a new ca-cert.pem file on the master, and re-distribute it to all remaining slaves & customer DB's (requiring all my DB's to be restarted).
Or could I just delete the server-cert.pem file from that one slave server?

(obviously I could revoke the username/password – but I'm trying to understand the SSL side at present).

Best Answer

Create the server and client cert/key files on the master server and then copy only the client cert/key files to each slave server and configure SSL replication. So basically you have the same client cert and key on all slave servers. If a slave gets compromised change the replication user's credentials.

Related Question