Skip to main content

Tutorial: Set up an SSL Connection to MySQL or AWS RDS

Abstract

Create an SSL connection between Access Server and a MySQL database to store your VPN server configuration.

Overview

With Access Server 2.9.0 and newer, you can make an encrypted connection to MySQL or AWS RDS servers.

You can configure one of three available modes for your database connection:

  1. Disabled: No SSL.

  2. Preferred: Create an SSL connection, but fallback to insecure if SSL isn't supported or can't be established.

    Note

    This is the default behavior.

  3. Required: The database connection is dropped if the certificate check fails.

Prerequisites

Option 1: Configure the SSL connection to a self-hosted MySQL or MariaDB server

  1. Generate client and server certificates on the MySQL server side to use SSL mode.

    Note

    Depending on the Linux OS of your database server, the server and client certificate generations can be included in the installation script. For more details on creating these certificates, refer to documentation from the OS vendor of the MySQL server package maintainer.

  2. Once you have the CA bundle, client certificate, and client private key files, rename them for their use.

    • In our example, we refer to them as mysql-as-CAbundle.crt, mysql-as-client.crt, and mysql-as-client.key.

  3. Upload your client certificate and CA bundle files to Access Server in this directory: /etc/ssl/certs/.

  4. Upload your client private key to Access Server in this directory: /etc/ssl/private/.

  5. Grant read rights to the file for Access Server:

    chown openvpn_as:openvpn_as /etc/ssl/certs/mysql-as-CAbundle.crt
chown openvpn_as:openvpn_as /etc/ssl/certs/mysql-as-client.crt
chown openvpn_as:openvpn_as /etc/ssl/private/mysql-as-client.key
chmod 644 /etc/ssl/certs/mysql-as-CAbundle.crt
chmod 644 /etc/ssl/certs/mysql-as-client.crt
chmod 640 /etc/ssl/private/mysql-as-client.key

  6. Configure these files for establishing a connection to the database server and define SSL mode by running these commands with root privileges in the /usr/local/openvpn_as/scripts/ directory:

    ./sacli --key "mysql.ssl_ca_cert" --value '/etc/ssl/certs/mysql-as-CAbundle.crt' ConfigPut
./sacli --key "mysql.ssl_auth_cert" --value '/etc/ssl/certs/mysql-as-client.crt' ConfigPut
./sacli --key "mysql.ssl_auth_key" --value '/etc/ssl/private/mysql-as-client.key' ConfigPut
./sacli --key "mysql.ssl_mode" --value "PREFERRED" ConfigPut

  7. Restart the Access Server service:

    service openvpnas restart

    Note

    Restarting the openvpnas service also forces all VPN connections to reconnect.

Option 2: Configure a MySQL SSL connection to AWS RDS

  1. Download the Amazon RDS certificate bundle file for your AWS region:

    Using SSL/TLS to encrypt a connection to a DB instance or cluster

    • AWS doesn’t provide client certificate or private key files, but uploading only the certificate bundle file is enough to establish a secure connection to an RDS MySQL database instance.

    Important

    AWS rotates certificate bundle files. Refer to Amazon’s documentation for details: Rotating your SSL/TLS certificate.

  2. Upload the AWS RDS CA bundle file to Access Server in this directory: /etc/ssl/certs/.

  3. Grant Access Server read rights to the file — using the correct .pem file name for the AWS bundle you uploaded:

    chown openvpn_as:openvpn_as /etc/ssl/certs/us-east-1-bundle.pem
chmod 644 /etc/ssl/certs/us-east-1-bundle.pem

  4. Configure these files for establishing a connection to the database server and define SSL mode by running these commands with root privileges in the /usr/local/openvpn_as/scripts/ directory:

    ./sacli --key "mysql.ssl_ca_cert" --value '/etc/ssl/certs/us-east-1-bundle.pem' ConfigPut
./sacli --key "mysql.ssl_mode" --value "PREFERRED" ConfigPut

    Important

    Ensure you replace us-east-1-bundle.pem with the name of the AWS RDS CA bundle for your region.

  5. Restart the Access Server service:

    service openvpnas restart

    Note

    Restarting the openvpnas service also forces all VPN connections to reconnect.

In this section: