Combining Root CA, Client Certificate and Private Key into a Single File

Combining Root CA, Client Certificate, and Private Key into a Single File

In this article, we will discuss the process of combining a Root Certificate Authority (CA), a client certificate, and a private key into a single file. This is useful for simplifying the management of certificates and keys, especially in a multi-server environment. We will focus on the context of using MySQL servers and clients.

Why Combine Root CA, Client Certificate, and Private Key?

Combining the Root CA, client certificate, and private key into a single file can simplify the process of distributing and managing certificates and keys in a multi-server environment. It also reduces the risk of misplacing or losing individual files. Additionally, it can help improve security by reducing the number of files that need to be protected.

Generating the Root CA, Client Certificate, and Private Key

Before generating the combined file, you need to create the Root CA, sign the server certificate, and create the client certificate. The following commands can be used to generate the Root CA and sign the server certificate:

# Generate the Root CA
openssl req -x509 -newkey rsa:4096 -keyout rootCA.key -out rootCA.crt -days 3650 -subj "/CN=My Root CA"

# Generate the server certificate signing request (CSR)
openssl req -newkey rsa:4096 -nodes -keyout server.key -out server.csr -subj "/CN=My Server"

# Sign the server certificate with the Root CA
openssl x509 -req -in server.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out server.crt -days 365 -sha256

Next, generate the client certificate:

# Generate the client certificate signing request (CSR)
openssl req -newkey rsa:4096 -nodes -keyout client.key -out client.csr -subj "/CN=My Client"

# Sign the client certificate with the Root CA
openssl x509 -req -in client.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out client.crt -days 365 -sha256

Combining the Root CA, Client Certificate, and Private Key

To combine the Root CA, client certificate, and private key into a single file, use the following command:

cat rootCA.crt client.crt client.key > combined.pem

The resulting file, combined.pem, will contain the Root CA, client certificate, and private key in a single file.

Using the Combined File with MySQL

To use the combined file with MySQL, you need to configure the server and client to use the certificate and key. The following commands can be used to configure the MySQL server:

# Stop the MySQL server
sudo systemctl stop mysql

# Start the MySQL server with SSL
sudo mysqld_safe --ssl-ca=combined.pem --ssl-cert=combined.pem --ssl-key=combined.pem &

To configure the MySQL client, use the following command:

# Connect to the MySQL server with SSL
mysql -u root -p --ssl-ca=combined.pem --ssl-cert=combined.pem --ssl-key=combined.pem

• Combining the Root CA, client certificate, and private key into a single file can simplify the management of certificates and keys in a multi-server environment.
• Use the cat command to combine the Root CA, client certificate, and private key into a single file.
• Configure the MySQL server and client to use the certificate and key by specifying the path to the combined file.

References

• Using SSL with MySQL

• How To Create a Self-Signed SSL Certificate for Apache in Ubuntu 16.04

• How To Create a Self-Signed SSL Certificate for Nginx in Ubuntu 16.04