---
title: 'Tutorial: Set up an SSL Connection to MySQL or AWS RDS'
canonical: https://openvpn.net/as-docs/v3/tutorials/tutorial--mysql-ssl-connection/
product: Access Server Docs
description: Create an SSL connection between Access Server and a MySQL database to store your VPN server configuration.
---

# Tutorial: Set up an SSL Connection to MySQL or AWS RDS

## Overview

Access Server supports encrypted connections to MySQL or AWS RDS servers.

You can configure one of three available modes for your database connection:

1. **Disabled:** No SSL.
2. **Preferred:** Create an SSL connection, but fallback to insecure if SSL isn't supported or can't be established.

   > **Note**
   >
   > This is the default behavior.
3. **Required:** The database connection is dropped if the certificate check fails.

## Prerequisites

- An installed Access Server [using a database server for the configuration files](https://openvpn.net/as-docs/v3/tutorials/tutorial--change-db-backend-gui.md).
- Root access to the Access Server console.
- Root access to the database server.

## Option 1: Configure the SSL connection to a self-hosted MySQL or MariaDB server

1. Generate client and server certificates on the MySQL server side to use SSL mode.

   > **Note**
   >
   > Depending on the Linux OS of your database server, the server and client certificate generations can be included in the installation script. For more details on creating these certificates, refer to documentation from the OS vendor of the MySQL server package maintainer.
2. Once you have the CA bundle, client certificate, and client private key files, rename them for their use.
   - In our example, we refer to them as **mysql-as-CAbundle.crt**, **mysql-as-client.crt**, and **mysql-as-client.key**.
3. Upload your client certificate and CA bundle files to Access Server in this directory: **/etc/ssl/certs/**.
4. Upload your client private key to Access Server in this directory: **/etc/ssl/private/**.
5. Grant read rights to the file for Access Server:

   ```
   chown openvpn_as:openvpn_as /etc/ssl/certs/mysql-as-CAbundle.crt
   chown openvpn_as:openvpn_as /etc/ssl/certs/mysql-as-client.crt
   chown openvpn_as:openvpn_as /etc/ssl/private/mysql-as-client.key
   chmod 644 /etc/ssl/certs/mysql-as-CAbundle.crt
   chmod 644 /etc/ssl/certs/mysql-as-client.crt
   chmod 640 /etc/ssl/private/mysql-as-client.key
   ```
6. Configure these files for establishing a connection to the database server and define SSL mode by running these commands with root privileges:

   ```
   sacli --key "mysql.ssl_ca_cert" --value '/etc/ssl/certs/mysql-as-CAbundle.crt' ConfigPut
   sacli --key "mysql.ssl_auth_cert" --value '/etc/ssl/certs/mysql-as-client.crt' ConfigPut
   sacli --key "mysql.ssl_auth_key" --value '/etc/ssl/private/mysql-as-client.key' ConfigPut
   sacli --key "mysql.ssl_mode" --value "PREFERRED" ConfigPut
   ```
7. Restart the Access Server service:

   ```
   systemctl restart openvpnas
   ```

   > **Note**
   >
   > Restarting the **openvpnas** service also forces all VPN connections to reconnect.

## Option 2: Configure a MySQL SSL connection to AWS RDS

1. Download the Amazon RDS certificate bundle file for your AWS region:

   [Using SSL/TLS to encrypt a connection to a DB instance or cluster](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html)
   - AWS doesn’t provide client certificate or private key files, but uploading only the certificate bundle file is enough to establish a secure connection to an RDS MySQL database instance.

   > **Important**
   >
   > AWS rotates certificate bundle files. Refer to Amazon’s documentation for details: [Rotating your SSL/TLS certificate](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL-certificate-rotation.html).
2. Upload the AWS RDS CA bundle file to Access Server in this directory: **/etc/ssl/certs/**.
3. Grant Access Server read rights to the file — using the correct .pem file name for the AWS bundle you uploaded:

   ```
   chown openvpn_as:openvpn_as /etc/ssl/certs/us-east-1-bundle.pem
   chmod 644 /etc/ssl/certs/us-east-1-bundle.pem
   ```
4. Configure these files for establishing a connection to the database server and define SSL mode by running these commands with root privileges:

   ```
   sacli --key "mysql.ssl_ca_cert" --value '/etc/ssl/certs/us-east-1-bundle.pem' ConfigPut
   sacli --key "mysql.ssl_mode" --value "PREFERRED" ConfigPut
   ```

   > **Important**
   >
   > Ensure you replace `us-east-1-bundle.pem` with the name of the AWS RDS CA bundle for your region.
5. Restart the Access Server service:

   ```
   systemctl restart openvpnas
   ```

   > **Note**
   >
   > Restarting the **openvpnas** service also forces all VPN connections to reconnect.

---

Prev: [Tutorial: Manually Change the Database Backend to MySQL or Amazon RDS from the Command Line](https://openvpn.net/as-docs/v3/tutorials/tutorial--change-db-backend-cli.md)
Next: [Logging and Debugging](https://openvpn.net/as-docs/v3/tutorials/logging-and-debugging.md)
Index: https://openvpn.net/as-docs/llms.txt