commit 523f4de084c43f76395b3278a4d8c6554b8f94eb
Author: Georg Richter <georg@mariadb.com>
Date:   Sat Dec 1 08:21:32 2018 +0100

    MDEV-14027: command line tools: Add support for finger print verification and passphrase protected keys

diff --git a/client/client_priv.h b/client/client_priv.h
index ffdf0fc4..b49d0a55 100644
--- a/client/client_priv.h
+++ b/client/client_priv.h
@@ -100,6 +100,8 @@ enum options_client
   OPT_SKIP_ANNOTATE_ROWS_EVENTS,
   OPT_SSL_CRL, OPT_SSL_CRLPATH,
   OPT_PRINT_ROW_COUNT, OPT_PRINT_ROW_EVENT_POSITIONS,
+  OPT_SSL_FP, OPT_SSL_FP_LIST,
+  OPT_SSL_PASSPHRASE,
   OPT_MAX_CLIENT_OPTION /* should be always the last */
 };
 
diff --git a/client/mysql.cc b/client/mysql.cc
index 4e94d092..30d8e5ba 100644
--- a/client/mysql.cc
+++ b/client/mysql.cc
@@ -1361,6 +1361,11 @@ static bool do_connect(MYSQL *mysql, const char *host, const char *user,
 		  opt_ssl_capath, opt_ssl_cipher);
     mysql_options(mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
     mysql_options(mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
+    mysql_options(mysql, MARIADB_OPT_SSL_FP, opt_ssl_fp);
+    mysql_options(mysql, MARIADB_OPT_SSL_FP_LIST, opt_ssl_fp_list);
+#if !defined(CC_HAVE_SCHANNEL)
+    mysql_options(mysql, MARIADB_OPT_TLS_PASSPHRASE, opt_ssl_passphrase);
+#endif
   }
   mysql_options(mysql,MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
                 (char*)&opt_ssl_verify_server_cert);
diff --git a/client/mysqladmin.cc b/client/mysqladmin.cc
index be81deb2..c00aa140 100644
--- a/client/mysqladmin.cc
+++ b/client/mysqladmin.cc
@@ -353,6 +353,12 @@ int main(int argc,char *argv[])
 		  opt_ssl_capath, opt_ssl_cipher);
     mysql_options(&mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
     mysql_options(&mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
+    mysql_options(&mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
+    mysql_options(&mysql, MARIADB_OPT_SSL_FP, opt_ssl_fp);
+    mysql_options(&mysql, MARIADB_OPT_SSL_FP_LIST, opt_ssl_fp_list);
+#if !defined(CC_HAVE_SCHANNEL)
+    mysql_options(&mysql, MARIADB_OPT_TLS_PASSPHRASE, opt_ssl_passphrase);
+#endif
   }
   mysql_options(&mysql,MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
                 (char*)&opt_ssl_verify_server_cert);
diff --git a/client/mysqlcheck.c b/client/mysqlcheck.c
index 432c7abc..e56cd1bf 100644
--- a/client/mysqlcheck.c
+++ b/client/mysqlcheck.c
@@ -1102,6 +1102,11 @@ static int dbConnect(char *host, char *user, char *passwd)
 		  opt_ssl_capath, opt_ssl_cipher);
     mysql_options(&mysql_connection, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
     mysql_options(&mysql_connection, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
+    mysql_options(&mysql_connection, MARIADB_OPT_SSL_FP, opt_ssl_fp);
+    mysql_options(&mysql_connection, MARIADB_OPT_SSL_FP_LIST, opt_ssl_fp_list);
+#if !defined(CC_HAVE_SCHANNEL)
+    mysql_options(&mysql_connection, MARIADB_OPT_TLS_PASSPHRASE, opt_ssl_passphrase);
+#endif
   }
 #endif
   if (opt_protocol)
diff --git a/client/mysqldump.c b/client/mysqldump.c
index fd720514..565d5758 100644
--- a/client/mysqldump.c
+++ b/client/mysqldump.c
@@ -1705,6 +1705,12 @@ static int connect_to_db(char *host, char *user,char *passwd)
                   opt_ssl_capath, opt_ssl_cipher);
     mysql_options(&mysql_connection, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
     mysql_options(&mysql_connection, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
+    mysql_options(&mysql_connection, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
+    mysql_options(&mysql_connection, MARIADB_OPT_SSL_FP, opt_ssl_fp);
+    mysql_options(&mysql_connection, MARIADB_OPT_SSL_FP_LIST, opt_ssl_fp_list);
+#if !defined(CC_HAVE_SCHANNEL)
+    mysql_options(&mysql_connection, MARIADB_OPT_TLS_PASSPHRASE, opt_ssl_passphrase);
+#endif
   }
   mysql_options(&mysql_connection,MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
                 (char*)&opt_ssl_verify_server_cert);
diff --git a/client/mysqlimport.c b/client/mysqlimport.c
index 2e4e8550..5a579229 100644
--- a/client/mysqlimport.c
+++ b/client/mysqlimport.c
@@ -443,6 +443,12 @@ static MYSQL *db_connect(char *host, char *database,
 		  opt_ssl_capath, opt_ssl_cipher);
     mysql_options(mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
     mysql_options(mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
+    mysql_options(mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
+    mysql_options(mysql, MARIADB_OPT_SSL_FP, opt_ssl_fp);
+    mysql_options(mysql, MARIADB_OPT_SSL_FP_LIST, opt_ssl_fp_list);
+#if !defined(CC_HAVE_SCHANNEL)
+    mysql_options(mysql, MARIADB_OPT_TLS_PASSPHRASE, opt_ssl_passphrase);
+#endif
   }
   mysql_options(mysql,MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
                 (char*)&opt_ssl_verify_server_cert);
diff --git a/client/mysqlshow.c b/client/mysqlshow.c
index d7c4dbec..846bde07 100644
--- a/client/mysqlshow.c
+++ b/client/mysqlshow.c
@@ -122,6 +122,11 @@ int main(int argc, char **argv)
 		  opt_ssl_capath, opt_ssl_cipher);
     mysql_options(&mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
     mysql_options(&mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
+    mysql_options(&mysql, MARIADB_OPT_SSL_FP, opt_ssl_fp);
+    mysql_options(&mysql, MARIADB_OPT_SSL_FP_LIST, opt_ssl_fp_list);
+#if !defined(CC_HAVE_SCHANNEL)
+    mysql_options(&mysql, MARIADB_OPT_TLS_PASSPHRASE, opt_ssl_passphrase);
+#endif
   }
   mysql_options(&mysql,MYSQL_OPT_SSL_VERIFY_SERVER_CERT,
                 (char*)&opt_ssl_verify_server_cert);
diff --git a/client/mysqlslap.c b/client/mysqlslap.c
index 3b9703fe..1295fb90 100644
--- a/client/mysqlslap.c
+++ b/client/mysqlslap.c
@@ -302,6 +302,11 @@ void set_mysql_connect_options(MYSQL *mysql)
                   opt_ssl_capath, opt_ssl_cipher);
     mysql_options(mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
     mysql_options(mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
+    mysql_options(mysql, MARIADB_OPT_SSL_FP, opt_ssl_fp);
+    mysql_options(mysql, MARIADB_OPT_SSL_FP_LIST, opt_ssl_fp_list);
+#if !defined(CC_HAVE_SCHANNEL)
+    mysql_options(mysql, MARIADB_OPT_TLS_PASSPHRASE, opt_ssl_passphrase);
+#endif
   }
 #endif
   if (opt_protocol)
diff --git a/client/mysqltest.cc b/client/mysqltest.cc
index f8c4f84a..6fbbd528 100644
--- a/client/mysqltest.cc
+++ b/client/mysqltest.cc
@@ -6118,6 +6118,12 @@ void do_connect(struct st_command *command)
 		  opt_ssl_capath, ssl_cipher ? ssl_cipher : opt_ssl_cipher);
     mysql_options(con_slot->mysql, MYSQL_OPT_SSL_CRL, opt_ssl_crl);
     mysql_options(con_slot->mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
+    mysql_options(con_slot->mysql, MYSQL_OPT_SSL_CRLPATH, opt_ssl_crlpath);
+    mysql_options(con_slot->mysql, MARIADB_OPT_SSL_FP, opt_ssl_fp);
+    mysql_options(con_slot->mysql, MARIADB_OPT_SSL_FP_LIST, opt_ssl_fp_list);
+#if !defined(CC_HAVE_SCHANNEL)
+    mysql_options(con_slot->mysql, MARIADB_OPT_TLS_PASSPHRASE, opt_ssl_passphrase);
+#endif
 #if MYSQL_VERSION_ID >= 50000
     /* Turn on ssl_verify_server_cert only if host is "localhost" */
     opt_ssl_verify_server_cert= !strcmp(ds_host.str, "localhost");
diff --git a/extra/mariabackup/xtrabackup.cc b/extra/mariabackup/xtrabackup.cc
index a79ad40b..75530227 100644
--- a/extra/mariabackup/xtrabackup.cc
+++ b/extra/mariabackup/xtrabackup.cc
@@ -200,6 +200,7 @@ static char*	log_ignored_opt;
 
 extern my_bool opt_use_ssl;
 my_bool opt_ssl_verify_server_cert;
+char *opt_ssl_fp, *opt_ssl_fp_list, *opt_ssl_passphrase;
 
 /* === metadata of backup === */
 #define XTRABACKUP_METADATA_FILENAME "xtrabackup_checkpoints"
diff --git a/include/sslopt-case.h b/include/sslopt-case.h
index 4a8c6594..a5f01c2e 100644
--- a/include/sslopt-case.h
+++ b/include/sslopt-case.h
@@ -24,6 +24,10 @@
     case OPT_SSL_CIPHER:
     case OPT_SSL_CRL:
     case OPT_SSL_CRLPATH:
+#ifdef MYSQL_CLIENT
+    case OPT_SSL_FP:
+    case OPT_SSL_FP_LIST:
+#endif
     /*
       Enable use of SSL if we are using any ssl option
       One can disable SSL later by using --skip-ssl or --ssl=0
diff --git a/include/sslopt-longopts.h b/include/sslopt-longopts.h
index e605d013..7867ee6e 100644
--- a/include/sslopt-longopts.h
+++ b/include/sslopt-longopts.h
@@ -52,6 +52,22 @@
    "when connecting. This option is disabled by default.",
    &opt_ssl_verify_server_cert, &opt_ssl_verify_server_cert,
    0, GET_BOOL, OPT_ARG, 0, 0, 0, 0, 0, 0},
+  {"ssl-fp", OPT_SSL_FP,
+   "Verify server certificate's finger print against "
+   "specified sha1 finger print (implies --ssl).",
+   &opt_ssl_fp, &opt_ssl_fp, 0, GET_STR, REQUIRED_ARG,
+   0, 0, 0, 0, 0, 0},
+  {"ssl-fplist", OPT_SSL_FP_LIST,
+   "Verify server certificate's finger print "
+   "against the specified file which must contain one or more sha1 finger prints (implies --ssl).",
+   &opt_ssl_fp_list, &opt_ssl_fp_list, 0, GET_STR, REQUIRED_ARG,
+   0, 0, 0, 0, 0, 0},
+#if !defined(CC_HAVE_SCHANNEL) && !defined(HAVE_YASSL)
+  {"ssl-passphrase", OPT_SSL_PASSPHRASE,
+    "Passphrase for passphrase protected key",
+   &opt_ssl_passphrase, &opt_ssl_passphrase, 0, GET_STR, REQUIRED_ARG,
+   0, 0, 0, 0, 0, 0},
 #endif
+#endif /* MYSQL_CLIENT */
 #endif /* HAVE_OPENSSL */
 #endif /* SSLOPT_LONGOPTS_INCLUDED */
diff --git a/include/sslopt-vars.h b/include/sslopt-vars.h
index 8e669760..e709bc7d 100644
--- a/include/sslopt-vars.h
+++ b/include/sslopt-vars.h
@@ -32,6 +32,11 @@ SSL_STATIC char *opt_ssl_crl     = 0;
 SSL_STATIC char *opt_ssl_crlpath = 0;
 #ifdef MYSQL_CLIENT
 SSL_STATIC my_bool opt_ssl_verify_server_cert= 0;
+SSL_STATIC char *opt_ssl_fp = 0;
+SSL_STATIC char *opt_ssl_fp_list = 0;
+#if !defined(CC_HAVE_SCHANNEL) && !defined(HAVE_YASSL)
+SSL_STATIC char *opt_ssl_passphrase = 0;
+#endif
 #endif
 #endif
 #endif /* SSLOPT_VARS_INCLUDED */
diff --git a/mysql-test/lib/generate-ssl-certs.sh b/mysql-test/lib/generate-ssl-certs.sh
index 8f15ba9d..5bbc6d53 100755
--- a/mysql-test/lib/generate-ssl-certs.sh
+++ b/mysql-test/lib/generate-ssl-certs.sh
@@ -21,6 +21,9 @@ openssl rsa -in server-key.pem -out server-key.pem
 # sign the server certificate with CA certificate
 openssl ca -keyfile cakey.pem -days 7300 -batch -cert cacert.pem -policy policy_anything -out server-cert.pem -infiles demoCA/server-req.pem
 
+# create sha1 finger print of server certificate
+openssl x509 -in server-cert.pem -sha1 -fingerprint -noout | sed 's/SHA1 Fingerprint=//g' > server-cert.sha1
+
 openssl req -newkey rsa:8192 -keyout server8k-key.pem -out demoCA/server8k-req.pem -days 7300 -nodes -subj '/CN=server8k/C=FI/ST=Helsinki/L=Helsinki/O=MariaDB'
 openssl rsa -in server8k-key.pem -out server8k-key.pem
 openssl ca -keyfile cakey.pem -days 7300 -batch -cert cacert.pem -policy policy_anything -out server8k-cert.pem -infiles demoCA/server8k-req.pem
@@ -29,6 +32,9 @@ openssl req -newkey rsa:1024 -keyout client-key.pem -out demoCA/client-req.pem -
 openssl rsa -in client-key.pem -out client-key.pem
 openssl ca -keyfile cakey.pem -days 7300 -batch -cert cacert.pem -policy policy_anything -out client-cert.pem -infiles demoCA/client-req.pem
 
+# generate password protected keys
+openssl rsa -des -in client-key.pem -passout pass:qwerty -out client-key-enc.pem
+
 # with SubjectAltName, only for OpenSSL 1.0.2+
 cat > demoCA/sanext.conf <<EOF
 subjectAltName=DNS:localhost
diff --git a/mysql-test/main/ssl_mdev14027_1.result b/mysql-test/main/ssl_mdev14027_1.result
new file mode 100644
index 00000000..67202e3e
--- /dev/null
+++ b/mysql-test/main/ssl_mdev14027_1.result
@@ -0,0 +1,11 @@
+create user ssl_user1@localhost;
+grant select on test.* to ssl_user1@localhost require SUBJECT "/C=FI/ST=Helsinki/L=Helsinki/O=MariaDB/CN=client";
+flush privileges;
+#protected key with passphrase
+ok
+ok
+#protected key with wrong passphrase
+#unprotected key with passphrase
+ok
+ok
+drop user ssl_user1@localhost;
diff --git a/mysql-test/main/ssl_mdev14027_1.test b/mysql-test/main/ssl_mdev14027_1.test
new file mode 100644
index 00000000..693834cd
--- /dev/null
+++ b/mysql-test/main/ssl_mdev14027_1.test
@@ -0,0 +1,20 @@
+-- source include/have_ssl_communication.inc
+
+# Save the initial number of concurrent sessions
+--source include/count_sessions.inc
+
+# schannel does not support passphrase protected keys
+-- source include/not_windows.inc
+
+--enable_warnings
+create user ssl_user1@localhost;
+grant select on test.* to ssl_user1@localhost require SUBJECT "/C=FI/ST=Helsinki/L=Helsinki/O=MariaDB/CN=client";
+flush privileges;
+--echo #protected key with passphrase
+--exec $MYSQL -ussl_user1 --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key-enc.pem --ssl-passphrase=qwerty -e"select 'ok'";
+--echo #protected key with wrong passphrase
+--error 1
+--exec $MYSQL -ussl_user1 --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key-enc.pem --ssl-passphrase=wrong -e"select 'not ok'";
+--echo #unprotected key with passphrase
+--exec $MYSQL -ussl_user1 --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem -e"select 'ok'";
+drop user ssl_user1@localhost;
diff --git a/mysql-test/main/ssl_mdev14027_2.result b/mysql-test/main/ssl_mdev14027_2.result
new file mode 100644
index 00000000..2675a18f
--- /dev/null
+++ b/mysql-test/main/ssl_mdev14027_2.result
@@ -0,0 +1,22 @@
+create user ssl_user1@localhost;
+grant select on test.* to ssl_user1@localhost require SUBJECT "/C=FI/ST=Helsinki/L=Helsinki/O=MariaDB/CN=client";
+create user ssl_user2@localhost;
+grant select on test.* to ssl_user2@localhost;
+flush privileges;
+#finger print with valid fp_list
+ok
+ok
+#finger print with non existing fp_list
+#finger print with valid fp
+ok
+ok
+#finger print with valid fp (without colons)
+ok
+ok
+#finger print with invalid fp
+#force tls/ssl by specifying fp_list
+ok
+ok
+#force tls/ssl by specifying invalid fp (must fail)
+connection default;
+drop user ssl_user1@localhost, ssl_user2@localhost;
diff --git a/mysql-test/main/ssl_mdev14027_2.test b/mysql-test/main/ssl_mdev14027_2.test
new file mode 100644
index 00000000..6a92220d
--- /dev/null
+++ b/mysql-test/main/ssl_mdev14027_2.test
@@ -0,0 +1,47 @@
+# Tests for SSL connections, only run if mysqld is compiled
+# with support for SSL.
+-- source include/have_ssl_communication.inc
+
+# Save the initial number of concurrent sessions
+--source include/count_sessions.inc
+
+--enable_warnings
+create user ssl_user1@localhost;
+grant select on test.* to ssl_user1@localhost require SUBJECT "/C=FI/ST=Helsinki/L=Helsinki/O=MariaDB/CN=client";
+create user ssl_user2@localhost;
+grant select on test.* to ssl_user2@localhost;
+flush privileges;
+
+# test finger print list
+--echo #finger print with valid fp_list
+--exec $MYSQL -ussl_user1 --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-fplist=$MYSQL_TEST_DIR/std_data/server-cert.sha1 -e"select 'ok'";
+--echo #finger print with non existing fp_list
+--error 1
+--exec $MYSQL -ussl_user1 --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-fplist=$MYSQL_TEST_DIR/std_data/file_not_found.sha1 -e"select 'not ok'";
+perl;
+  use strict;
+  my $infile= "$ENV{MYSQL_TEST_DIR}/std_data/server-cert.sha1";
+  open(my $fh, '<:encoding(UTF-8)', $infile);
+  my $sha_colon= $fh;
+  chomp $sha_colon;
+  close($fh);
+  my $sha_no_colon= $sha_colon;
+  $sha_no_colon= ~ s/://g;
+EOF
+--echo #finger print with valid fp
+--exec $MYSQL -ussl_user1 --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-fp=$sha_colon  -e"select 'ok'";
+
+--echo #finger print with valid fp (without colons)
+--exec $MYSQL -ussl_user1 --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-fp=$sha_no_colon -e"select 'ok'";
+--echo #finger print with invalid fp
+--error 1
+--exec $MYSQL -ussl_user1 --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-fp=11:11:11:11 -e"select 'not ok'";
+
+--echo #force tls/ssl by specifying fp_list
+--exec $MYSQL -ussl_user2 --ssl-fplist=$MYSQL_TEST_DIR/std_data/server-cert.sha1 -e"select 'ok'";
+
+--echo #force tls/ssl by specifying invalid fp (must fail)
+--error 1
+--exec $MYSQL -ussl_user2 --ssl-fp=01:02:03:04:05 -e"select 'not ok'";
+connection default;
+drop user ssl_user1@localhost, ssl_user2@localhost;
diff --git a/mysql-test/std_data/client-key-enc.pem b/mysql-test/std_data/client-key-enc.pem
new file mode 100644
index 00000000..6982ec3d
--- /dev/null
+++ b/mysql-test/std_data/client-key-enc.pem
@@ -0,0 +1,18 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: DES-CBC,E034D0380B63CFD2
+
+5uJgOhr6nusftIY565Tq/nZpUYpdk59i9aGBKwuhUdyjZYKrkmLjvg5hU2LjAyZb
+kfQy67EK5S0/Bdc4CT8yLxuwptHv/G5NbMkmezi0QzPWvj15czuete3bvcQKrJzw
+c54JEhAi1bKwfsbHUdejb2P3dgqsMnem6AHgHGT7VytDDwyJtT4ynadMcAiLykZv
+j0rddI1HqASr9kHGvwgz98A5bhCWaPFVPLTL7VeFJwUrrHMFzVTGg18IeZgSGcVR
+38F2vqIxHAeAoj/J/VctwfyZ83j2m6aHbx0oFFItpHoZxfgv4ooucvQHjBAaQiXj
+J3ofAjERNxMcLcqYg2+IdVLBRExoi1sxMUHbD2w535gdDZRizCI9ibs6fs/pt4QG
+h4PBAxXqNhUBSoXWzeWXKsZ4Wf68aPez71/3FpibEhVRtljaCFURw7B6gsq7NVkz
+m2jqzmk4pkm+HFhTPB2AtW+RzuQ3iD/AYFdERn1tv+aj0of3BhznlWrTLjDRcdPT
+xRI7mKWDuqD5sBIog95D0O2qG/LQSwh5a6JUufDXJWYliqS0aEygj9Q9Ge0V//Jl
+71eRDzuRuMebvy7RZcW7NIwOnEpXiQFLudZy9Omd89iw1QQdQKtdinXBiZgpHC28
+nb1riR73hkwjftaod8aoWxEw77MeJPgoqcNBdkiatBsU2QVw+caJ8BtvyBhiKF/w
+vDYa2cX8TYqaiAlay2TpCM0LXuP2i/rc4UkhCjszUt4geuwtb/0wPM7yuXHuNQeC
+PrHATTxPS0cTQhqoJuQnhBM9M7WjYfgcXt58BByMYqKHEhHW24iQ3w==
+-----END RSA PRIVATE KEY-----
diff --git a/mysql-test/std_data/server-cert.sha1 b/mysql-test/std_data/server-cert.sha1
new file mode 100644
index 00000000..fc74a800
--- /dev/null
+++ b/mysql-test/std_data/server-cert.sha1
@@ -0,0 +1 @@
+64:37:78:F9:51:B1:1E:89:73:1F:14:3C:1D:72:16:80:B4:3D:70:80