GreatSQL 配置 SSL 訪問：單機與 MGR 集群指南
作者：土豆娃娃
為確保數據庫中傳輸數據的安全性與完整性，防止敏感信息在通信過程中被竊聽或篡改，建議為GreatSQL服務啟用SSL加密連接。此舉尤其適用于不安全的網絡環境（如公有網絡），或需滿足行業數據安全合規性要求的場景。
背景說明
為確保數據庫中傳輸數據的安全性與完整性，防止敏感信息在通信過程中被竊聽或篡改，建議為GreatSQL服務啟用SSL加密連接。此舉尤其適用于不安全的網絡環境（如公有網絡），或需滿足行業數據安全合規性要求的場景。以下文檔將詳述配置GreatSQL服務器端強制SSL連接，并為客戶端頒發證書的具體操作步驟。
單機開啟SSL
通過命令，初始化密鑰文件，其中datadir與數據庫數據目錄保持一致。
/greatsql/gdb/svr/greatsql/bin/mysql_ssl_rsa_setup --datadir=/greatsql/gdb/dbdata/3313/data
chown greatsql.greatsql /greatsql/gdb/dbdata/3313/data/*pem會產生如下新的文件：
$ ll /greatsql/gdb/dbdata/3313/data/*pem
-rw------- 1 greatsql greatsql 1679 Sep 15 11:34 /greatsql/gdb/dbdata/3313/data/ca-key.pem
-rw-r--r-- 1 greatsql greatsql 1115 Sep 15 11:34 /greatsql/gdb/dbdata/3313/data/ca.pem
-rw-r--r-- 1 greatsql greatsql 1115 Sep 15 11:34 /greatsql/gdb/dbdata/3313/data/client-cert.pem
-rw------- 1 greatsql greatsql 1679 Sep 15 11:34 /greatsql/gdb/dbdata/3313/data/client-key.pem
-rw------- 1 greatsql greatsql 1676 Sep 15 11:32 /greatsql/gdb/dbdata/3313/data/private_key.pem
-rw-r--r-- 1 greatsql greatsql 452 Sep 15 11:32 /greatsql/gdb/dbdata/3313/data/public_key.pem
-rw-r--r-- 1 greatsql greatsql 1115 Sep 15 11:34 /greatsql/gdb/dbdata/3313/data/server-cert.pem
-rw------- 1 greatsql greatsql 1679 Sep 15 11:34 /greatsql/gdb/dbdata/3313/data/server-key.pem在配置文件中，添加全局加密通信要求參數。
require_secure_transport=ON此時通過非socket訪問數據庫均要求SSL通信。
$ /greatsql/gdb/svr/greatsql/bin/mysql -ubing -p'abc123' -h172.17.134.55 -P3313 --ssl-mode=disable
mysql: [Warning] Using a password on the command line interface can be insecure.
ERROR 3159 (HY000): Connections using insecure transport are prohibited while --require_secure_transport=ON.
$ /greatsql/gdb/svr/greatsql/bin/mysql -ubing -p'abc123' -h172.17.134.55 -P3313
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 13
Server version: 8.0.32-27 GreatSQL, Release 27, Revision aa66a385910
Copyright (c) 2021-2025 GreatDB Software Co., Ltd
Copyright (c) 2009-2025 Percona LLC and/or its affiliates
Copyright (c) 2000, 2025, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h'forhelp. Type '\c' to clear the current input statement.
greatsql> \s
--------------
/greatsql/gdb/svr/greatsql/bin/mysql Ver 8.0.32-27 for Linux on x86_64 (GreatSQL, Release 27, Revision aa66a385910)
Connection id: 13
Current database:
Current user: bing@172.17.134.55
SSL: Cipher in use is ECDHE-RSA-AES128-GCM-SHA256
Current pager: stdout
Using outfile: ''
Using delimiter: ;
Server version: 8.0.32-27 GreatSQL, Release 27, Revision aa66a385910
Protocol version: 10
Connection: 172.17.134.55 via TCP/IP
Server characterset: utf8mb4
Db characterset: utf8mb4
Client characterset: utf8mb4
Conn. characterset: utf8mb4
TCP port: 3313
Binary data as: Hexadecimal
Uptime: 6 min 1 sec
Threads: 3 Questions: 19 Slow queries: 0 Opens: 150 Flush tables: 3 Open tables: 69 Queries per second avg: 0.052
--------------如果要求必須使用正確的SSL證書文件才能登錄，則需要設置數據庫賬號權限為X509。
ALTER USER bing require x509;無證書登錄則報錯。
$ /greatsql/gdb/svr/greatsql/bin/mysql -ubing -p'abc123' -h172.17.134.55 -P3313
mysql: [Warning] Using a password on the command line interface can be insecure.
ERROR 1045 (28000): Access denied for user 'bing'@'172.17.134.55' (using password: YES)有證書登錄則正常。
$ /greatsql/gdb/svr/greatsql/bin/mysql -ubing -p'abc123' -h172.17.134.55 -P3313 --ssl-ca=/greatsql/gdb/dbdata/3313/data/ca.pem --ssl-cert=/greatsql/gdb/dbdata/3313/data/client-cert.pem --ssl-key=/greatsql/gdb/dbdata/3313/data/client-key.pem
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 12
Server version: 8.0.32-27 GreatSQL, Release 27, Revision aa66a385910
Copyright (c) 2021-2025 GreatDB Software Co., Ltd
Copyright (c) 2009-2025 Percona LLC and/or its affiliates
Copyright (c) 2000, 2025, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h'forhelp. Type '\c' to clear the current input statement.
greatsql> \s
--------------
/greatsql/gdb/svr/greatsql/bin/mysql Ver 8.0.32-27 for Linux on x86_64 (GreatSQL, Release 27, Revision aa66a385910)
Connection id: 12
Current database:
Current user: bing@172.17.134.55
SSL: Cipher in use is ECDHE-RSA-AES128-GCM-SHA256
Current pager: stdout
Using outfile: ''
Using delimiter: ;
Server version: 8.0.32-27 GreatSQL, Release 27, Revision aa66a385910
Protocol version: 10
Connection: 172.17.134.55 via TCP/IP
Server characterset: utf8mb4
Db characterset: utf8mb4
Client characterset: utf8mb4
Conn. characterset: utf8mb4
TCP port: 3313
Binary data as: Hexadecimal
Uptime: 5 min 17 sec
Threads: 3 Questions: 13 Slow queries: 0 Opens: 150 Flush tables: 3 Open tables: 69 Queries per second avg: 0.041
--------------MGR 開啟SSL
數據庫參數中添加配置
loose-group_replication_ssl_mode = REQUIRED
loose-group_replication_recovery_use_ssl = 1證書生成
任意一種方式配置均能成功啟用SSL。
MGR組內只能通過同一個ca.pem生成其他證書，否則連接會失敗。
方法一(每個實例單獨SSL文件，安全性高)
通過腳本，生成每個節點的SSL相關證書，輸入IP地址的證書，只能在對應服務器上使用。
gen_ca_server_client_cert.sh （腳本文件有需要聯系小助手獲取）
[root@gdb01-001 /data/tmp]$ sh gen_ca_server_client_cert.sh 192.168.0.4
未檢測到CA文件，正在生成統一CA...
Generating RSA private key, 4096bit long modulus (2 primes)
.............................................................................++++
................++++
e is 65537 (0x010001)
已生成統一CA: ca.pem, ca-key.pem
正在生成 Server 證書...
Generating RSA private key, 2048 bit long modulus (2 primes)
.......+++++
......+++++
e is 65537 (0x010001)
Signature ok
subject=CN = 192.168.0.4
Getting CA Private Key
192.168.0.4-server-cert.pem: OK
Server證書生成完成:
- 私鑰: 192.168.0.4-server-key.pem
- 證書: 192.168.0.4-server-cert.pem
正在生成 Client 證書...
Generating RSA private key, 2048bit long modulus (2 primes)
......................................................................................+++++
...........................................................................................................................+++++
e is 65537 (0x010001)
Signature ok
subject=CN = 192.168.0.4-client
Getting CA Private Key
192.168.0.4-client-cert.pem: OK
Client證書生成完成:
- 私鑰: 192.168.0.4-client-key.pem
- 證書: 192.168.0.4-client-cert.pem
統一 CA: ca.pem / ca-key.pem
Server證書: 192.168.0.4-server-cert.pem / 192.168.0.4-server-key.pem
Client證書: 192.168.0.4-client-cert.pem / 192.168.0.4-client-key.pem
完整流程完成
[root@gdb01-001 /data/tmp]#
[root@gdb01-001 /data/tmp]$ sh gen_ca_server_client_cert.sh 192.168.0.5
檢測到已有CA: ca.pem, ca-key.pem，直接使用
正在生成 Server 證書...
Generating RSA private key, 2048bit long modulus (2 primes)
...........................................................................................................................................+++++
..................................+++++
e is 65537 (0x010001)
Signature ok
subject=CN = 192.168.0.5
Getting CA Private Key
192.168.0.5-server-cert.pem: OK
Server證書生成完成:
- 私鑰: 192.168.0.5-server-key.pem
- 證書: 192.168.0.5-server-cert.pem
正在生成 Client 證書...
Generating RSA private key, 2048bit long modulus (2 primes)
..............................................................................+++++
........+++++
e is 65537 (0x010001)
Signature ok
subject=CN = 192.168.0.5-client
Getting CA Private Key
192.168.0.5-client-cert.pem: OK
Client證書生成完成:
- 私鑰: 192.168.0.5-client-key.pem
- 證書: 192.168.0.5-client-cert.pem
統一 CA: ca.pem / ca-key.pem
Server證書: 192.168.0.5-server-cert.pem / 192.168.0.5-server-key.pem
Client證書: 192.168.0.5-client-cert.pem / 192.168.0.5-client-key.pem
完整流程完成
[root@gdb01-001 /data/tmp]#
[root@gdb01-001 /data/tmp]$ sh gen_ca_server_client_cert.sh 192.168.0.3
檢測到已有CA: ca.pem, ca-key.pem，直接使用
正在生成 Server 證書...
Generating RSA private key, 2048bit long modulus (2 primes)
.....................+++++
.........+++++
e is 65537 (0x010001)
Signature ok
subject=CN = 192.168.0.3
Getting CA Private Key
192.168.0.3-server-cert.pem: OK
Server證書生成完成:
- 私鑰: 192.168.0.3-server-key.pem
- 證書: 192.168.0.3-server-cert.pem
正在生成 Client 證書...
Generating RSA private key, 2048bit long modulus (2 primes)
.......+++++
...........+++++
e is 65537 (0x010001)
Signature ok
subject=CN = 192.168.0.3-client
Getting CA Private Key
192.168.0.3-client-cert.pem: OK
Client證書生成完成:
- 私鑰: 192.168.0.3-client-key.pem
- 證書: 192.168.0.3-client-cert.pem
統一 CA: ca.pem / ca-key.pem
Server證書: 192.168.0.3-server-cert.pem / 192.168.0.3-server-key.pem
Client證書: 192.168.0.3-client-cert.pem / 192.168.0.3-client-key.pem
完整流程完成
[root@gdb01-001 /data/tmp]#將6個文件scp到證書目錄，注意調整屬主。
SSL文件分發：
scp ca-key.pem ca.pem 192.168.0.5-client-key.pem 192.168.0.5-client-cert.pem 192.168.0.5-server-cert.pem 192.168.0.5-server-key.pem 192.168.0.5:/greatsql/gdb/dbdata/3313/ssl_files
scp ca-key.pem ca.pem 192.168.0.4-client-key.pem 192.168.0.4-client-cert.pem 192.168.0.4-server-cert.pem 192.168.0.4-server-key.pem 192.168.0.4:/greatsql/gdb/dbdata/3313/ssl_files
scp ca-key.pem ca.pem 192.168.0.3-client-key.pem 192.168.0.3-client-cert.pem 192.168.0.3-server-cert.pem 192.168.0.3-server-key.pem 192.168.0.3:/greatsql/gdb/dbdata/3313/ssl_files重命名SSL文件名rename '192.168.0.5-' '' *
[root@gdb01-003 /greatsql/gdb/dbdata/3313/ssl_files]$ ll
total 24K
-rw-r--r-- 1 greatsql greatsql 1.4K Sep 13 20:48 192.168.0.5-client-cert.pem
-rw-r--r-- 1 greatsql greatsql 1.7K Sep 13 20:48 192.168.0.5-client-key.pem
-rw-r--r-- 1 greatsql greatsql 1.4K Sep 13 20:48 192.168.0.5-server-cert.pem
-rw-r--r-- 1 greatsql greatsql 1.7K Sep 13 20:48 192.168.0.5-server-key.pem
-rw-r--r-- 1 greatsql greatsql 3.2K Sep 13 20:48 ca-key.pem
-rw-r--r-- 1 greatsql greatsql 1.8K Sep 13 20:48 ca.pem
[root@gdb01-003 /greatsql/gdb/dbdata/3313/ssl_files]# rename '192.168.0.5-' '' *
[root@gdb01-003 /greatsql/gdb/dbdata/3313/ssl_files]# ll
total 24K
-rw-r--r-- 1 greatsql greatsql 3.2K Sep 13 20:48 ca-key.pem
-rw-r--r-- 1 greatsql greatsql 1.8K Sep 13 20:48 ca.pem
-rw-r--r-- 1 greatsql greatsql 1.4K Sep 13 20:48 client-cert.pem
-rw-r--r-- 1 greatsql greatsql 1.7K Sep 13 20:48 client-key.pem
-rw-r--r-- 1 greatsql greatsql 1.4K Sep 13 20:48 server-cert.pem
-rw-r--r-- 1 greatsql greatsql 1.7K Sep 13 20:48 server-key.pem并且要在每個實例的配置文件中，添加如下配置。
ssl-ca=/greatsql/gdb/dbdata/3313/ssl_files/ca.pem
ssl-cert=/greatsql/gdb/dbdata/3313/ssl_files/server-cert.pem
ssl-key=/greatsql/gdb/dbdata/3313/ssl_files/server-key.pem驗證證書有效期。
openssl x509 -in server-cert.pem -noout -dates方法二(所有實例SSL文件相同，使用方便)
在第一個節點直接通過下面的命令初始化好證書。
/greatsql/gdb/svr/greatsql/bin/mysql_ssl_rsa_setup --datadir=/greatsql/gdb/dbdata/3313/data
chown greatsql.greatsql /greatsql/gdb/dbdata/3313/data/*pem在其他節點，直接通過clone復制數據，然后通過scp復制證書，雖然這樣會導致所有節點證書均一致，但是不影響使用。
greatsql> SET GLOBAL clone_valid_donor_list='192.168.0.4:3313';
Query OK, 0 rows affected (0.00 sec)
greatsql> CLONE INSTANCE FROM greatsql@192.168.0.4:3313 IDENTIFIED BY '!QAZ2wsx';
scp ca-key.pem ca.pem client-key.pem client-cert.pem server-cert.pem server-key.pem 192.168.0.3:/greatsql/gdb/dbdata/3313/ssl_files查詢MGR中SSL生效狀態
SELECT * FROM performance_schema.replication_group_members;查看SSL生效。
greatsql> SHOW VARIABLES LIKE 'group_replication_ssl_mode';
+----------------------------+----------+
| Variable_name | Value |
+----------------------------+----------+
| group_replication_ssl_mode | REQUIRED |
+----------------------------+----------+
1 row inset (0.00 sec)
greatsql> SHOW VARIABLES LIKE 'group_replication_recovery_use_ssl';
+------------------------------------+-------+
| Variable_name | Value |
+------------------------------------+-------+
| group_replication_recovery_use_ssl | ON |
+------------------------------------+-------+
1 row inset (0.00 sec)責任編輯：武曉燕
來源：
GreatSQL社區
