Details
-
New Feature
-
Status: In Review (View Workflow)
-
Major
-
Resolution: Unresolved
Description
Problem
MariaDB currently loads only a single certificate into its SSL context. Services like httpd, nginx, and haproxy can serve both RSA and ECDSA certificates simultaneously, selecting the appropriate one based on the cipher suite negotiated with the client. A TLS-terminating proxy cannot be used as a workaround because MySQL uses a STARTTLS-like in-protocol SSL upgrade.
Implementation (PR #5178)
Following the plugin-load / plugin-load-add pattern:
- ssl-cert / ssl-key override the primary cert/key and reset any previously added alt certs/keys
- ssl-cert-add / ssl-key-add append additional certs/keys. If no primary exists, the first add becomes the primary
Each additional certificate is loaded via SSL_CTX_use_certificate_chain_file() so intermediate CA chains are included. Up to 3 certificates are supported (matching OpenSSL's per-key-type model: RSA, ECDSA, EdDSA).
Each ssl-cert-add must be positionally matched with a corresponding ssl-key-add.
Example configurations:
[mysqld]
|
ssl-cert=/path/to/server-rsa.crt
|
ssl-key=/path/to/server-rsa.key
|
ssl-cert-add=/path/to/server-ecdsa.crt
|
ssl-key-add=/path/to/server-ecdsa.key
|
or equivalently (first add becomes primary):
[mysqld]
|
ssl-cert-add=/path/to/server-rsa.crt
|
ssl-key-add=/path/to/server-rsa.key
|
ssl-cert-add=/path/to/server-ecdsa.crt
|
ssl-key-add=/path/to/server-ecdsa.key
|
New status variables
| Variable | Scope | Description |
|---|---|---|
| Ssl_server_cert_type | Session | Key type of the certificate used for this connection (RSA, ECDSA, EdDSA) |
| Ssl_server_cert_types | Global | All certificate key types loaded (e.g. "RSA, ECDSA, EdDSA") |
WolfSSL
Multiple certificates are not supported with WolfSSL (see MDEV-36656). The ssl-cert-add / ssl-key-add options are not registered on WolfSSL builds. The cert type enumeration for Ssl_server_cert_types falls back to reporting only the primary cert type. Tests are skipped on WolfSSL builds. Code compiles cleanly with both OpenSSL and bundled WolfSSL.
Tests
- ssl_multi_cert: 2 tests (RSA + ECDSA cipher-based selection), no server restart
- ssl_multi_cert_tlsv13: TLS 1.3 with EdDSA verification, no server restart
- ssl_multi_cert_errors: 16 tests (invalid files, count mismatches, reset behavior, FLUSH SSL, order independence, first-add-becomes-primary)
Out of scope
- Client/server option parity: client tools accepting multi-cert options (lives in libmariadb)