In a comment on my post about Using SSL with MySQL xiaochong zhang asked if it is possible to decode SSL/TLS encrypted MySQL traffic. The short answer is: It depends. To test this we need a MySQL server which is SSL enabled. I used MySQL Sandbox to create a sandboxed 5.6.19 server. Then I used mysslgen to create the config and the certificates. $ make_sandbox 5.6.19 $ ./mysslgen.py --config=sandboxes/msb_5_6_19/my.sandbox.cnf --ssldir=sandboxes/msb_5_6_19/ssl This assumes there already is a extracted tarball of MySQL 5.6.19 in ~/mysql/5.6.19 The mysslgen.py script will return a message with the changes you should make in your mysqld and client sections of the my.sandbox.cnf file. Then restart the server to make it active. For SSL to work we need to connect using TCP/IP instead of over a UNIX socket. So we connect with "./my sql -h 127.0.0.1". Now execute "\s" or "status" to see if we're indeed using SSL. It probably looks like this: mys...

I've blogged before about how complicated setting up SSL with MySQL can be. Since then many bugs have been fixed related to SSL. But still many people are using unencrypted connections for replication and client connections. This could be because of possible performance degradation. But then it could be used for only the admin connections. It could also be because they already use SSH or VPN. But for many it's because they think it's complicated. This is not necessary. I've created mysslgen which makes it easier to setup SSL. Just run mysslgen.py and then the CA, server and client certificates and keys will be generated for you. The most difficult part it to get python 3.3 or python 2.7 to run on CentOS/RHEL/OEL 6. If you think SSL should be part of the default MySQL installation, then click the 'Affects me' button for Bug #70734 . During the creation of mysslgen I found out MySQL fails to load private keys if they are in PKCS#8 format ( Bug #71271 ...