title: MYSQL remote connection require SSL
body: <p>I'm seeking to clear some information up for myself involving remote SSL connections to MYSQL. Particularly, once I have MYSQL setup to enable SSL and have a remote user that requires SSL.</p>
  
  <p>This is how I connect (commandline), remotely, to MYSQL with a user that requires SSL:</p>
  
  <blockquote>
    <p>mysql -uMyUserName -p -h192.168.5.5 --ssl-ca /path/to/ca.pem</p>
  </blockquote>
  
  <p><br>
  My question is: <strong>Why do I have to provide the ca.pem file as the client?</strong></p>
  
  <p><br>
  These are the steps I took to install mysql on the server and setup remote access (Ubuntu):
  <br>
  <br></p>
  
  <h2>Steps to Enable SSL for MYSQL</h2>
  
  <p>1) Obtain my Certificate Authority cert, Database cert, Database key</p>
  
  <ul>
  <li>ca.pem   (Certificate Authority cert)</li>
  <li>dbcert.pem (Database cert)</li>
  <li>dbkey.pem (Databse key)</li>
  </ul>
  
  <p>2) Add the following lines to <em>/etc/mysql/my.cnf</em> under [mysqld]</p>
  
  <blockquote>
    <p>ssl-ca=/path/to/ca.pem<br>
    ssl-cert=/path/to/dbcert.pem<br>
    ssl-key=/path/to/dbkey.pem</p>
  </blockquote>
  
  <p><a href="https://i.stack.imgur.com/lAA0G.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/lAA0G.png" alt="enter image description here"></a></p>
  
  <p>3) Restart mysql and confirm ssl enabled by logging in and typing following: </p>
  
  <blockquote>
    <p>show variables like '%ssl%';   </p>
  </blockquote>
  
  <p><br></p>
  
  <p><a href="https://i.stack.imgur.com/ylFP6.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ylFP6.png" alt="enter image description here"></a></p>
  
  <p><br></p>
  
  <h2>Configure Remote Connection Requiring SSL</h2>
  
  <p>1) Comment out the following lines in <em>/etc/mysql/my.cnf</em></p>
  
  <blockquote>
    <p>#bind-address<br>
    #skip-networking</p>
  </blockquote>
  
  <p>2) Login to mysql and grant a user access to, in this case, every database</p>
  
  <blockquote>
    <p>GRANT ALL PRIVILEGES ON <em>.</em> to 'USERNAME'@'%' IDENTIFIED BY 'PASSWORD' REQUIRE SSL</p>
  </blockquote>
  
  <p><br></p>
  
  <p>At this point, I have MYSQL setup to enable SSL &amp;&amp; I have a remote user that will require SSL to login. I am able to login on a remote commandline, but i need to specify the --ssl-ca. </p>
  
  <p><strong>Why do I have to provide the ssl-ca from client? Is there a way to do this so that I don't have to?</strong> </p>
  
  <p>I would really appreciate some insight here.</p>
  
  <p>Thanks in advance.</p>