Proxysql SSL ca cert RDS

Polyglot Projects ProxySQL
1

How to connect to RDS with ssl in AWS from Proxysql?
Only have the CA-cert root certificate from aws to connect to RDS.
I can connect directly from the server that has proxysql installed.
mysql -udlewis -p -h rds.instance.rds.amazonaws.com -P3306 --ssl-ca /etc/ssl/certs/rds-ca-2019-root.pem
I can not connect with ssl from proxysql
mysql -udlewis -p -h 127.0.0.1 -P3306 --ssl-ca /home/dlewis/rds-ca-2019-root.pem
or
mysql -udlewis -p -h 127.0.0.1 -P3306

variables:
| mysql-have_ssl | true |
| mysql-ssl_p2s_ca | /etc/mysql/ssl/rds-ca-2019-root.pem |
| mysql-ssl_p2s_cert | |
| mysql-ssl_p2s_key | |
| mysql-ssl_p2s_cipher | |

1 Like
2

Hi, there seems to be a few configs missing. Please check SSL Encryption at ProxySQL Part 1 - ProxySQL
for instructions

1 Like
3

Can I get a hint at what was missed?

1 Like
4

Hi, front end encryption is different from backend encryption in ProxySQL. The client to proxysql connections (frontend) should use the key/cert generated by proxysql, not the RDS pem file.
The RDS cert is only used to encrypt backed (proxysql to rds) connections.

See SSL Support · sysown/proxysql Wiki · GitHub

1 Like
5

It’s always better to use different key/cert for the frontend and backend connection’s.
The main challenge is resolving incases where you setup using a public certificate (CA).

1 Like