title: How to use encrypted connection with MySQL on Docker
body: <p>I'm struggling to get a Dockerised MySQL instance to support SSL.</p>
  
  <p>The service in my docker-compose file looks like this:</p>
  
  <pre><code>  mysql:
      image: mysql:5.7
      container_name: mysql
      command: --default-authentication-plugin=mysql_native_password --ssl-ca=/etc/ssl/mysql/ca.pem --ssl-cert=/etc/ssl/mysql/server-cert.pem --ssl-key=/etc/ssl/mysql/server-key.pem
      restart: always
      expose:
        - 3306
      environment:
        MYSQL_ROOT_PASSWORD: "${MYSQL_ROOT_PASSWORD}"
        MYSQL_DATABASE: "${MYSQL_DATABASE}"
        MYSQL_USER: "${MYSQL_USER}"
        MYSQL_PASSWORD: "${MYSQL_PASSWORD}"
      volumes:
        - "./data/db:/var/lib/mysql"
        - "./config/mysql/my.cnf:/etc/mysql/conf.d/ssl.cnf"
        - "./config/mysql/certs:/etc/ssl/mysql"
  </code></pre>
  
  <p>When I start up the stack I get these errors from the MySQL container:</p>
  
  <pre><code>[ERROR] SSL error: Unable to get private key from '/etc/ssl/mysql/server-key.pem'
  [Warning] Failed to set up SSL because of the following SSL library error: Unable to get private key
  </code></pre>
  
  <p>I've tried to chown the key from <code>root</code> to <code>mysql</code> and then bring up the stack again, but that doesn't seem to work.</p>
  
  <p>I generated the key files from the commands at <a href="https://dev.mysql.com/doc/refman/5.7/en/creating-ssl-files-using-openssl.html" rel="nofollow noreferrer">https://dev.mysql.com/doc/refman/5.7/en/creating-ssl-files-using-openssl.html</a>, like this:</p>
  
  <pre><code># Create server certificate, remove passphrase, and sign it
  # server-cert.pem = public key, server-key.pem = private key
  openssl req -newkey rsa:2048 -days 3600 \
          -nodes -keyout server-key.pem -out server-req.pem
  openssl rsa -in server-key.pem -out server-key.pem
  openssl x509 -req -in server-req.pem -days 3600 \
          -CA ca.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem
  </code></pre>
  
  <p>The files on the host have the following permissions:</p>
  
  <pre><code>drwxrwxr-x 2 andrew andrew 4096 Dec 11 10:25 ./
  drwxrwxr-x 3 andrew andrew 4096 Dec 10 19:27 ../
  -rw-rw-r-- 1    999 docker 1675 Dec 10 19:20 ca-key.pem
  -rw-rw-r-- 1    999 docker 1294 Dec 10 19:20 ca.pem
  -rw-rw-r-- 1    999 docker 1123 Dec 10 19:20 client-cert.pem
  -rw-rw-r-- 1    999 docker 1679 Dec 10 19:20 client-key.pem
  -rw-rw-r-- 1    999 docker  989 Dec 10 19:20 client-req.pem
  -rw-rw-r-- 1    999 docker 1127 Dec 10 19:20 server-cert.pem
  -rw------- 1    999 docker 1675 Dec 11 10:25 server.key
  -rw-rw-r-- 1    999 docker 1704 Dec 11 09:43 server-key.pem
  -rw-rw-r-- 1    999 docker  956 Dec 11 09:43 server-req.pem
  </code></pre>
  
  <p>This happens if I manually generate the certificates and mount them as a volume, or if I run a shell on the container and run the command <code>mysql_ssl_rsa_setup --datadir=/etc/ssl/mysql --verbose</code> (after clearing out the certificates that I created).  In other words when I run <code>openssl verify -CAfile ca.pem server-cert.pem client-cert.pem</code> I see that both certificates are "OK" (no matter which way I generate them).</p>
  
  <p>Why can't MySQL find the private key from that file?</p>