Details
-
New Feature
-
Status: Closed (View Workflow)
-
Critical
-
Resolution: Fixed
-
10.3.3-1
Description
When using a password-protected key, MariaDB server can not start because the server waits for a key to be entered:
Enter PEM pass phrase:
Since this doesn't work if server is started as a service or as background process, an additional option --ssl-passphrase should be implemented (as in Connector/C).
Update, 17 Feb 2025
We take OpenSSL approach, where --passin/passout parameters to the command line tool can specify a file ("file:" prefix), environment variable ("env:" prefix) , clear-text password("pass:" prefix)
Note, that if ssl_passphrase is reevaluated on FLUSH SSL. That means for file-based passphrase (ssl_passphrase=file:/path/to/pass.txt), that the file will be re-read during FLUSH SSL.
Attachments
Issue Links
- blocks
-
MXS-4102 Support for passphrase protected certificate keys
-
- Closed
-
- is duplicated by
-
MDEV-17290 Mechanism for encrypting ssl_key
-
- Closed
-