备份数据库是生产环境中的首要任务，重中之重，有时候不得不通过网络进行数据库的复制，这样就需要保证数据在网络传输过程中的安全性，因此使用基于SSL的复制会大加强数据的安全性

二、准备工作

1、主从服务器时间同步

[root@master CA] # (umask 077;openssl genrsa -out private/cakey.pem 2048) [root@master CA] # [root@master CA] # openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 36500 If you enter '.' , the field will be left blank. Common Name (eg, your name or your server's hostname ) []:master.sina.com [root@master CA] # touch index.txt serial crlnumber [root@master CA] # echo 01 > serial [root@master ssl] # (umask 077;openssl genrsa -out master.key 2048) [root@master ssl] # [root@master ssl] # openssl req -new -key master.key -out master.csr -days 36500 If you enter '.' , the field will be left blank. Common Name (eg, your name or your server's hostname ) []:master.sina.com Please enter the following 'extra' attributes [root@master ssl] # [root@master ssl] # openssl ca -in master.csr -out master.crt -days 36500 Using configuration from /etc/pki/tls/openssl .cnf Serial Number: 1 (0x1) Validity Not Before: May  3 13:34:58 2014 GMT Not After : Apr  9 13:34:58 2114 GMT Subject: countryName               = CN stateOrProvinceName       = Beijing organizationName          = sina organizationalUnitName    = mysql commonName                = master.sina.com X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 62:EF:37:1D:96:FF:8A:89:47:09:2D:93:74:42:14:BF:8E:AC:51:49 X509v3 Authority Key Identifier: keyid:6B:73:D6:FE:81:13:2C:0E:EC:61:EE:F7:6F:92:91:6D:82:37:A0:11 Certificate is to be certified until Apr  9 13:34:58 2114 GMT (36500 days) Sign the certificate? [y /n ]:y 1 out of 1 certificate requests certified, commit? [y /n ]y [root@slave ssl] # (umask 077;openssl genrsa -out slave.key 2048) [root@slave ssl] # [root@slave ssl] # openssl req -new -key slave.key -out slave.csr -days 36500 If you enter '.' , the field will be left blank. Common Name (eg, your name or your server's hostname ) []:slave.sina.com Please enter the following 'extra' attributes [root@slave ssl] # [root@slave ssl] # [root@slave ssl] # scp slave.csr root@172.16.7.202:/root Using configuration from /etc/pki/tls/openssl .cnf Serial Number: 2 (0x2) Validity Not Before: May  3 13:43:28 2014 GMT Not After : Apr  9 13:43:28 2114 GMT Subject: countryName               = CN stateOrProvinceName       = Beijing organizationName          = sina organizationalUnitName    = mysql commonName                = slave.sina.com X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 20:CB:55:9C:D0:7A:F0:25:70:AC:84:2B:8E:F4:24:FB:1F:51:48:9D X509v3 Authority Key Identifier: keyid:6B:73:D6:FE:81:13:2C:0E:EC:61:EE:F7:6F:92:91:6D:82:37:A0:11 Certificate is to be certified until Apr  9 13:43:28 2114 GMT (36500 days) Sign the certificate? [y /n ]:y 1 out of 1 certificate requests certified, commit? [y /n ]y [root@master ~] # [root@master ~] # [root@master ~] # scp slave.crt root@172.16.7.250:/usr/local/mysql/ssl/ [root@slave ssl] # chown -R mysql.mysql /usr/local/mysql/ssl/ [root@slave ssl] # ll /usr/local/mysql/ssl/ MariaDB [(none)]> show variables like '%ssl%' ; | ssl_ca        | /usr/local/mysql/ssl/cacert .pem | | ssl_cert      | /usr/local/mysql/ssl/master .crt | | ssl_key       | /usr/local/mysql/ssl/master .key | MariaDB [(none)]> grant replication slave,replication client on *.* to 'repluser' @ '172.16.%.%' identified by 'repluser' require ssl; MariaDB [(none)]> show variables like '%ssl%' ; | ssl_ca        | /usr/local/mysql/ssl/cacert .pem | | ssl_cert      | /usr/local/mysql/ssl/slave .crt  | | ssl_key       | /usr/local/mysql/ssl/slave .key  | MariaDB [(none)]> change master to master_host= '172.16.7.202' ,master_user= 'repluser' ,master_password= 'repluser' ,master_log_file= 'master-bin.000002' ,master_log_pos=652,master_ssl=1,master_ssl_ca= '/usr/local/mysql/ssl/cacert.pem' ,master_ssl_cert= '/usr/local/mysql/ssl/slave.crt' ,master_ssl_key= '/usr/local/mysql/ssl/slave.key' ; Slave_IO_State: Waiting for master to send event Master_Host: 172.16.7.202 Master_User: repluser Master_Port: 3306 Connect_Retry: 60 Master_Log_File: master-bin.000002 Read_Master_Log_Pos: 652 Relay_Log_File: relay.000002 Relay_Log_Pos: 536 Relay_Master_Log_File: master-bin.000002 Slave_IO_Running: Yes Slave_SQL_Running: Yes Replicate_Do_DB: Replicate_Ignore_DB: Replicate_Do_Table: Replicate_Ignore_Table: Replicate_Wild_Do_Table: Replicate_Wild_Ignore_Table: Last_Errno: 0 Last_Error: Skip_Counter: 0 Exec_Master_Log_Pos: 652 Relay_Log_Space: 823 Until_Condition: None Until_Log_File: Until_Log_Pos: 0 Master_SSL_Allowed: Yes Master_SSL_CA_File: /usr/local/mysql/ssl/cacert .pem Master_SSL_CA_Path: Master_SSL_Cert: /usr/local/mysql/ssl/slave .crt Master_SSL_Cipher: Master_SSL_Key: /usr/local/mysql/ssl/slave .key Seconds_Behind_Master: 0 Last_IO_Errno: 0 Last_IO_Error: Last_SQL_Errno: 0 Last_SQL_Error: Replicate_Ignore_Server_Ids: Master_Server_Id: 1 Master_SSL_Crl: /usr/local/mysql/ssl/cacert .pem Master_SSL_Crlpath: Using_Gtid: No Gtid_IO_Pos: 1 row in set (0.00 sec) | test | 【C#】【MySQL】【配置数据源】SSL Connection error 发生一个或多个错误。由于·意外的数据包格式，握手失败 版权声明：本文首发 http://asing1elife.com ，转载请注明出处。 https://blog.csdn.net/asing1elife/article/details/82696866