Connecting to MySQL server with ssl
<p>So I need to connect to a MySQL server over SSL.  I have root access on both server and client.  The OS on both server and client is Ubuntu Linux.  The server is running MySQL 5.5.46.</p>

<p>I generated certificates following the instructions at:</p>

<p><a href="http://dev.mysql.com/doc/refman/5.5/en/creating-ssl-files-using-openssl.html" rel="nofollow">http://dev.mysql.com/doc/refman/5.5/en/creating-ssl-files-using-openssl.html</a></p>

<p>This created eight .pem files.  I successfully got the server to run with SSL enabled. I know because if I get the MySQL prompt on the server and run:</p>

<pre><code>mysql&gt; show global variables like 'have_%ssl';
</code></pre>

<p>I get:</p>

<pre><code>+---------------+-------+
| Variable_name | Value |
+---------------+-------+
| have_openssl  | YES   |
| have_ssl      | YES   |
+---------------+-------+
</code></pre>

<p>I also put the correct privileges on the user who will be connecting to this server. I know because If I do:</p>

<pre><code>show grants for &lt;username&gt;
</code></pre>

<p>I get a GRANT statement with "REQUIRE SSL" on the end.  So I really think the server side is good to go.</p>

<p>Connecting from the client is the problem.  I <em>can</em> do it if I use the "-p" option like this:</p>

<pre><code>$ mysql --ssl-ca=./path/to/ca.pem -h &lt;hostname&gt; -u &lt;username&gt; -D &lt;databasename&gt; -p
</code></pre>

<p>Then I get prompted for my password, and if I enter it, I can connect.</p>

<p>But I need to automate this connection, and appending the password to the line above is a bad idea (and never works anyway - which I also wonder about).</p>

<p>So how can I securely connect to the client in an automated way without hardcoding a password?  When I generated the certificates following the instructions at the link above I got eight .pem documents, most of which I'm not using.  Do I need to be using client-key.pem?  client-cert.pem?  Please note that passing paths to those other certificates on the command line does not work.  That is, this:</p>

<pre><code>mysql --ssl-ca=./ca.pem --ssl-cert=./client-cert.pem --ssl-key=./client-key.pem -h &lt;hostname&gt; -u &lt;username&gt; -D &lt;databasename&gt;
</code></pre>

<p>fails just like all other combinations of the above: "Access denied"</p>

<p>Any help is much appreciated.</p>