Adds TLS certificates

mysql/Dockerfile

@@ -31,6 +31,11 @@ RUN chmod 755 /usr/local/bin/*
 ENV MYSQL_TCP_PORT=3306
 
 ADD my.cnf /etc/mysql/mysql.cnf
+ADD tls/ca.pem /etc/mysql/ssl/ca.pem
+ADD tls/server-cert.pem /etc/mysql/ssl/server-cert.pem
+ADD tls/server-key.pem /etc/mysql/ssl/server-key.pem
+RUN chown -R mysql:mysql /etc/mysql/ssl
+
 
 # MTK - A toolkit for exporting, sanitizing and packaging MySQL database.
 # https://github.com/skpr/mtk

mysql/my.cnf

@@ -2,6 +2,11 @@
 disable_log_bin
 port=3306
 bind-address = 0.0.0.0
+ssl_ca = /etc/mysql/ssl/ca.pem
+ssl_cert = /etc/mysql/ssl/server-cert.pem
+ssl_key = /etc/mysql/ssl/server-key.pem
+tls_version = TLSv1.2,TLSv1.3
+require_secure_transport = OFF
 sql_mode=STRICT_TRANS_TABLES,NO_ENGINE_SUBSTITUTION,NO_AUTO_VALUE_ON_ZERO
 connect_timeout = 10
 innodb_buffer_pool_size = 128M

mysql/tls/ca.key

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDhMbRResoYqjo3
+a8jygb5Gd/kAhWFve9fLT/HwvfdNYHht2vMBdxxRWctsBZq+TcMRECA0qtjIvFRZ
+7jtLTIJ1G9qQwdUlMcSVpDZR2phlyA4s179eZVTk0oB/c6eGBWvZ3TtgJIEC+jqy
+t5brgNrr3fugUC2nxMaZR7N0t2udCz9PLZaa8V2QS/NGQXQCzxqQGJ9rF9Id8Eud
+dchSm53E33dNeAfXua3JmYpUbrp/K3LMCB6dVcW+enuu91e2sZx1iRE1+tbGw27o
+qx0mhOVpzqYCtKJUlqxNjzRthEYo+1MbNWglBkmjJGEi7SxDaXjewhg/8QEm7m3p
+ItzPcS3DcuZzv1Oq7a5KU8CvGoU3nbv6ZvuBqYd88ishdVmpQdcrcwN8iQa1QdnZ
+wGiAoPmnxqMgbp52FthGwzTLU0Q7TS678ccTx489/NWPZSoONXjMvPrwK28QaiF9
+A1zaYG07CsYqh8hY1fBWZ+w/IPykYTdah5RZP1nmNQLZFPVe6UuuQysGqoeGrwA0
+Gi/a06mCQ5Q5SurYCjiR6zhbT2by2WqFlbiYPsGgUDV8dewlICPgZFsX/b+3ZQ/y
+mG/57cJXJ8eVvU2xszFpNULk4nLu8Q0JuQRs5eZ5ob+CQ4KxmD0t6Q/EJGJlRRzp
+hgU/gllTKMp++8aISxQHJaNUO+JnoQIDAQABAoICAAiLShyxeIJAete64aY41RCH
+prALP30wkSlpablb0x/xkMmAk4nVpvfbsjJcUT4Wms0hOWBCL1ozZ2MSR8KQPzQP
+XTGIQdc+I4fWxzRVGMU7gUqDL44MG8aC9EWRrJRy93VN9b3MuMPgB7Lbm3C+mXUg
+8vYmy0qooRfe+XCMhoXaz8QSwNp1XVqh6mj68gUVbkaza8tZ3VAjO5KNzdlQ2/GE
+qy+VEKgcfIW6qyh6WzNYwXY7ZHeipy9rpoPG5kIxYYmF7IbJqFU6LvFfOlU0LjT0
+4RssbGsiRzHkpMVhzccqMkxPmw6qOx2YXg1KZiHoeixqfRYiUDbAeGADzCYHP2hk
+fDIzpJT985ZAO51BBICNDkRIpf0MEbMSTrVkncG28lJ5tImXoDQ8hFceWbtWZ3I1
+Y6ifNO3KCGupYvyb/q14Dul+LGo/ZtWQ+z/cQvHuE7/UUoZb4YW5xXLrsDX8RNjR
+KmEb8zXrTpT2NlE7vivLhxp/J+lmy9ZR5VDvuRR0bYS9h2Lv59IDlaZkj8VjSCVQ
+c/tU86Zm5OSNPVs9YdjBNqpNtZTGS5Q9MQ9i6qfecmmJCWL9W8XgERn1UDQJaYCH
+R8Pnbhdz7mqnzpEnrCqWAOj8VQZY2eeOCvxP9rQ1ZQGgIuOVr6eap65arHgedhz/
+Ih09S63nSdHzLxMd31/pAoIBAQDx3bIcdatyCVaL3He6Oy15+UHACoiPBsCMcuee
+5Pc5QhnWcq2rXOO9iuLP9H7KCwJ3dRhNC57UCD1yDtpqskQNlDH/UGdkCrDrPYeR
+h16U3MUFsdeG9INT+vCbw08pnxnZ17Vx+t12qExy/lQxUWStX0OUog8bVQLt0vps
+BIZYfB7HRLEcsqiFKbS3trmPhh9W4sOOrOvIIhJn0y4GCR4eqnCU+lXDT0axFIzR
+bSG8jrBBSjXZ7gOqvJc0/xk5UqHTgR2Y+FKIb1YkS/kqr/JIum3LYiDL8zbDg6Wh
+AsqYKT6K4SfJfbSDOt1CC7YFRYeGHQ3R1fJ415BHbYb1IxLpAoIBAQDuWplAdxcE
+d3kMQz6S2hvBjW7qZCVWf/MEpMBQYZJrI9k+4D/hRCpRXkT2lfRC6Rvi+cgFjDNj
+NFhjdovJsWaOah11eC27IuKVJlV6kwnqfIb1w4QTjGyVMxfpJCqqohLT5pMUXwwE
+TL4qP4Kg+GM/miA2w5xxrpvYxHZ/CWhxg/QMWUB0+uwHdcQOB485dAlxYRrVZQWe
+dGXfYr4QF/d6mu5Tk9TSrC1DasfT0QIiZ71nbmohTdYl8ODxFcUl/aq4uV1KFFwQ
+K7We8PZBKfY1rMs4KK1Pv3nv1tGPPb/XgTBY7PV/QjqTr+8Z/ezl5kFhksKN3Gci
+g2ARSSo4LQv5AoIBAQCGLDoWV6CYTl3YkKFKinGb7I5w/mbrEQ/X2hZrqxEKjoTO
+1idJnOopx9YzDqsXYiwoIKkudHfToA6WK283KVVfQwrJW80/Tj7/AM8oCDSL2Dzj
+/9hUYWhJOjgn8J0FteEdW/CoHkalAJAIatZB1alIFETlO1GuE+bgD94j9g6hH5nj
+aVPnW6To2k4KbC9cU0cnZ/ycNYlHKL+VIS2y43P2Bw8VVholkuDgc0n7E9NXSsC0
+N3rQPp2CJcSr/af8iL6FGmdU6MzAKyNaV1sONzTs657k6LbQ7UdABtPnEilZZ+fu
+GyF7QWTWN91uOhjrq7qWx59W/JzaNJsxRK1NZ/uhAoIBAQCM9snh5UyYmKvfQ7mz
+EgkOTD4Ho1itspgf6+vM3hfBA3+M/wToje7VFoKEryS5mbGjaAQSu9r8Vc3cbRS5
+IRC9Mybe/UdWgIgum3A8QM/BfQo4OPxYr1jcWE5Q1NHi/l1SMvBTQO8Tb+ubgtoX
+py7TQ6y/lqpkVVbYOUC3WvIJCHgCAZrsVCXZN53Oikv7N5QKGNrMz6UmFELXfUdY
+r0Pun8hJZ4mbWraeQ32Q2PCBNoc+r39W2PjIkZAHJM/m6wHXo9D3adkUuzT7nhiV
+a2KwVdQOD4iIPH66CHsBUwytQDs+rE14iMup4ofvAEzlnmqWcTxct7fLIpVjQ7kT
+ZhjJAoIBADVPnSIVs9Bjg55LGpBsT5ExotmDz1DM/LTX51YA/shjQGA8zwjzAqw1
+yWvE0WS4L6kbKdwV3vRM/xt3n4MsV6pI735FYtccCHo3k5CE758W+Bx5x11Dbik/
+UUe0HAK/OmtbQIF2/7MVQMT0sWRhGsHiph8k0CNKLIHsML9KxNqZdP7YpeZPnnc9
+NbiJVsLQfz7QwwXP1LkBhlTAcO8FOhYw6LjWQCVz5Ogh/BE38/uSi6sKOF21ib3P
+sK2kfaV5nLP4n0K3fXXtAgk84KPOFiWlMLtSYHPP4kndJ7cernAMgW31lhLy+aU0
+DNsAO7ankEQTFWPnOHtoP7yorH65kcA=
+-----END PRIVATE KEY-----

mysql/tls/ca.pem

@@ -0,0 +1,30 @@
+-----BEGIN CERTIFICATE-----
+MIIFETCCAvmgAwIBAgIUdKc4YnS3H4wsroEW99L8M88RlBcwDQYJKoZIhvcNAQEL
+BQAwGDEWMBQGA1UEAwwNTXlTUUwgVGVzdCBDQTAeFw0yNTA5MTEwNTU3MzZaFw0z
+NTA5MDkwNTU3MzZaMBgxFjAUBgNVBAMMDU15U1FMIFRlc3QgQ0EwggIiMA0GCSqG
+SIb3DQEBAQUAA4ICDwAwggIKAoICAQDhMbRResoYqjo3a8jygb5Gd/kAhWFve9fL
+T/HwvfdNYHht2vMBdxxRWctsBZq+TcMRECA0qtjIvFRZ7jtLTIJ1G9qQwdUlMcSV
+pDZR2phlyA4s179eZVTk0oB/c6eGBWvZ3TtgJIEC+jqyt5brgNrr3fugUC2nxMaZ
+R7N0t2udCz9PLZaa8V2QS/NGQXQCzxqQGJ9rF9Id8EuddchSm53E33dNeAfXua3J
+mYpUbrp/K3LMCB6dVcW+enuu91e2sZx1iRE1+tbGw27oqx0mhOVpzqYCtKJUlqxN
+jzRthEYo+1MbNWglBkmjJGEi7SxDaXjewhg/8QEm7m3pItzPcS3DcuZzv1Oq7a5K
+U8CvGoU3nbv6ZvuBqYd88ishdVmpQdcrcwN8iQa1QdnZwGiAoPmnxqMgbp52FthG
+wzTLU0Q7TS678ccTx489/NWPZSoONXjMvPrwK28QaiF9A1zaYG07CsYqh8hY1fBW
+Z+w/IPykYTdah5RZP1nmNQLZFPVe6UuuQysGqoeGrwA0Gi/a06mCQ5Q5SurYCjiR
+6zhbT2by2WqFlbiYPsGgUDV8dewlICPgZFsX/b+3ZQ/ymG/57cJXJ8eVvU2xszFp
+NULk4nLu8Q0JuQRs5eZ5ob+CQ4KxmD0t6Q/EJGJlRRzphgU/gllTKMp++8aISxQH
+JaNUO+JnoQIDAQABo1MwUTAdBgNVHQ4EFgQUWonZ6UC1+BfJjc3LiBcjzucqGjYw
+HwYDVR0jBBgwFoAUWonZ6UC1+BfJjc3LiBcjzucqGjYwDwYDVR0TAQH/BAUwAwEB
+/zANBgkqhkiG9w0BAQsFAAOCAgEAuS4D2kqzf9GlbYrUPFms8g46ei/ZWSBgrijv
+2GrJj1RPcyrBnPVfWglKZCtOiATkLLjkKtdsAalbU/KRC9OJqi05i8MqOkC6lbZa
+vbk75sPggvFNLK14He+3j6t9iUAlBBZMw3drzBxmlED/Fy6AijA/UHMHgz11aXy0
+5cJ5dViEUMixPFP27/v2+mu3ah56UNegi4jIph7RBSnbgGwDxvJ/vJjfRBYibM2h
+6GZ1a34BHJrF3waCssYBruTrKvjDqpoKT7Pgvq7eo/MIzc7H8wD1slgq3KlK3dz2
+qOZvrWMSCCIrJC5N8FRgNOFtqfGfPYEri3rFzp5cDyw8E3+d8CuGYBlXXbpeRxg1
+iQ7skKu1TZ8F3NJINOGawsr5cn26BFX5UhcgHvC2cR7bgxSOhnNkhdK2zC4seuBV
+RWaDMjzw2+VV9mW0tWx8F7Y4Ylna6dXJSdkD2Dgqe+Q25vqU95jSKoKxDCpj2Hku
+Ecoz0nkMut/nOJbAl52lUPhgDFzyafw2rMhr7wZSJ+74mXE2cf7PsvlZEi8RVJy3
+CkwYKpLkj5kneLN04iHTLgkTU29h3DhkaVRGQ5s2yiJe6ezuCoXvGBf02POZPXAJ
+UJ/mm7uQI+8BW94YAUzennz/T2/4+W1JRqgeue+sosGVSD8KMLh2bX6ZsP+nvxnD
+0whha+c=
+-----END CERTIFICATE-----

mysql/tls/ca.srl

@@ -0,0 +1 @@
+37EEB7499B93A03855339DC0423069CBDF06E1C3

mysql/tls/generate.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+
+# Used to regenerate our development certificates.
+# NEVER TO BE USED IN PRODUCTION.
+# LOCAL DEVELOPMENT ONLY.
+
+# Create a private CA
+openssl genrsa -out ca.key 4096
+openssl req -new -x509 -days 3650 -key ca.key -out ca.pem -subj "/CN=MySQL Test CA"
+
+# Create a server key/csr
+openssl genrsa -out server-key.pem 2048
+openssl req -new -key server-key.pem -out server.csr -subj "/CN=localhost"
+
+# Self sign certificates
+cat > server-ext.cnf <<'EOF'
+subjectAltName=DNS:localhost
+keyUsage = digitalSignature, keyEncipherment
+extendedKeyUsage = serverAuth
+EOF
+openssl x509 -req -in server.csr -CA ca.pem -CAkey ca.key -CAcreateserial \
+  -out server-cert.pem -days 825 -extfile server-ext.cnf
+chmod 600 server-key.pem
+

mysql/tls/server-cert.pem

@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIENDCCAhygAwIBAgIUN+63SZuToDhVM53AQjBpy98G4cMwDQYJKoZIhvcNAQEL
+BQAwGDEWMBQGA1UEAwwNTXlTUUwgVGVzdCBDQTAeFw0yNTA5MTEwNTU3MzZaFw0y
+NzEyMTUwNTU3MzZaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAJsxFH0B0lfnLJ5xuPtbXUR3qtoTX0qZEDfKw6E5
+JRNwxEJJFb/QHy+IZERctYHHECVsgG8at6Nid2gyZfiGeADeW2ubK8XAwFv2K2cI
+sm7Zs2HijATTpTKtYO620lJkcQoiOpLOUxBoU6G9zlw2LkFQrtgl2/5SW4WrT8TW
+v9HXwn1etLgPNRHsbS176W6rsS1A5vSnkasBJth8hPWIZBLUd+TXiRDZh5KwvUvC
+vVES+9az3WjnYoNRf33ccjG4H3Qtuf0nQCEE4lpvVosxWGD0ItHBCTojJqmVEJTJ
+VPge5Hbv4jqCe6Q0gU+4XW1dJzYwaBIScpmECFU8eu9NBfMCAwEAAaN6MHgwFAYD
+VR0RBA0wC4IJbG9jYWxob3N0MAsGA1UdDwQEAwIFoDATBgNVHSUEDDAKBggrBgEF
+BQcDATAdBgNVHQ4EFgQUCWd+FTHDjLpJJzXMWsxsxHNpRrkwHwYDVR0jBBgwFoAU
+WonZ6UC1+BfJjc3LiBcjzucqGjYwDQYJKoZIhvcNAQELBQADggIBAH55/Ed68Sud
+mT8KNKTV/gvqFGqqZU+ZMrctot/+2IdMaYxMW7+TT3qbMloYor+WBWCGn9mHudUq
+KtlFx2nNZy/8kSo9YP5173dzURD8ajI44Ibb9JPEF2t7WXk20CVqJvE29ECTvH5f
+g5QkzfQ4S8n2slRh0ffPQrAr+TwqyTbsRtoYuHCQXDzzlt67ZqG3Nl7qR37yV7Mm
+7L9TVyuopP5DhjFxo8Mgxw3SqARiOaqE1lUYu3a4MWjoPOxF1K/VdxJdMiDAKgI0
+t0fOM8yp8eaiO5fpGPqRRBaE4Fh597iJDUF7RWMFBRw/0vRwnBdx7Imt9tPMXadC
+BFOUCkqCmhX/hgunZ/fabdym6HOxbb0ltp2/BxF9PMcS9B0MAVFEkhJgUDX7GAhu
+3JjVVsEn2IzHqeE8RTtROTC4H8n5F7gneBc2mhAoNFTYE+9pF/R3cxwek4bqrv6K
+cS2x5bX95qFBYLW/UQypyHwdS+lkfaIEPKq2fv1sSEuqh63hzo2Q8jfJ/d+HUduj
+MgM+9xHl1f297sLSMgMhRpR9uxKYZCD40W4AKTWYwMh1ksgbYgWGPqHeg306XDeU
+tKCGgskRRGwqNterbS70khuXjZTVz2gr7mUSEHE9IzwS+GMeVG1PzuAx7qFGfePo
+moLEVj87N9mjIe9H1y8jfVenjoiZETFa
+-----END CERTIFICATE-----

mysql/tls/server-ext.cnf

@@ -0,0 +1,3 @@
+subjectAltName=DNS:localhost
+keyUsage = digitalSignature, keyEncipherment
+extendedKeyUsage = serverAuth

mysql/tls/server-key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCbMRR9AdJX5yye
+cbj7W11Ed6raE19KmRA3ysOhOSUTcMRCSRW/0B8viGREXLWBxxAlbIBvGrejYndo
+MmX4hngA3ltrmyvFwMBb9itnCLJu2bNh4owE06UyrWDuttJSZHEKIjqSzlMQaFOh
+vc5cNi5BUK7YJdv+UluFq0/E1r/R18J9XrS4DzUR7G0te+luq7EtQOb0p5GrASbY
+fIT1iGQS1Hfk14kQ2YeSsL1Lwr1REvvWs91o52KDUX993HIxuB90Lbn9J0AhBOJa
+b1aLMVhg9CLRwQk6IyaplRCUyVT4HuR27+I6gnukNIFPuF1tXSc2MGgSEnKZhAhV
+PHrvTQXzAgMBAAECggEAOrKxoSaTPJQ/mB5DbS79c+wfPyScokaKj8+tdsl6cIPy
+d2/VPhul8ACSjBjUviVgwgbr/RoJ405XA54sW3fg49M2mNi0EbP6Dc5qVCpB8xN8
+ecWKWDkE/sn9I80ad/dtmfugU+6eFFKhb0evSclkbWfq+e4361WTMFe/cCAZpXBz
+F62JseuHfrTXKR9UIywqi/HUnnLKfdH+Y5CyYkY19qMTvMqv4oyRJLiySCjEZCaR
+cNs3XxqOPzLZ2YdTzTy6ca76IhwP8x7uK+HdxKc2Z38iQXOg7zShxJhH6q3noahf
+kZ1jDGxRdMQknZNfwyfLjcjOrZzF6sj926U9hYsoYQKBgQDUPELml8E+QAN3sU9q
+rxbIrummdQfLTIjxbBx+M3zJ6GHLJmjVZVwN+3nhIlOnAaKzO7cFAOqN6en9bVgy
+uYpQH5S2ACsGbsmFh4EIAYW5X54+HHcwt+OlM4C1se8V7irLbqrR6ZIRUpAeDrDa
+ouv9nJVbDEunTo/Ez/D16TFPRwKBgQC7MYcyo8haG1s0NxPHTgQ4wiCNIFPLpoJ+
+J5pWIC91BOLZXEEMBRZornP330qv5H84tPcPPgmp/XzlXt6+vZ25Cg8qOvgn2803
+SP7QWZ3KuZBJv0Qeyic0h14MHjzpp60dLyIGluzicCdo5VIP7AgqPqL6SLR1Cpqd
+Hb1Gsvwh9QKBgQCnhCkJ+R3+FGioQLt+aVSCcgzZ5eWRAYfVho+2zMziURlfT6HP
+TYGrR6KboIyGdTQGZEvBF0gLW2XlMjk7UFdrhoHKZbeQDEHjs2CVAR6bgm1UeQNa
+4Mo9yrj8sMUVejcs+ty5crJoGdLG5rGQ4KeENeNtSfcsx0WTAs4eS0EwYQKBgQCy
+HbtuFOezzWnn8ixQrUxZEWZVwpfZJFPwZBB3uOJPL1oGxsBiBok/DBfumDoByaLA
+O3kFuNsLM9bejXnW9qeYBRlO7pNnob7PxxYm+86nsg+4DFVuEp5hXhi/4RnGnjSb
+m1h9+qfmAh+NsP53hfhy8eyzx/BlmbRqoXyTRAWi7QKBgQC2h2rRBInJ0VZlkPLU
+HkG8wFZTwkUG4xxoLceSFVzrKcETFmCEdhgKyUwIowvlEMN8p7JEsY0XP9SBpWXh
+4cYt95hlWjlS0WJ+PROUJxDSpIYVBilw/iMZQYYZkCiqrjHrNMlRAAhkKrlfHbtY
+A7gbDOomuJKulqK6lemlWz+t8A==
+-----END PRIVATE KEY-----

mysql/tls/server.csr

@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICWTCCAUECAQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAmzEUfQHSV+csnnG4+1tdRHeq2hNfSpkQN8rDoTkl
+E3DEQkkVv9AfL4hkRFy1gccQJWyAbxq3o2J3aDJl+IZ4AN5ba5srxcDAW/YrZwiy
+btmzYeKMBNOlMq1g7rbSUmRxCiI6ks5TEGhTob3OXDYuQVCu2CXb/lJbhatPxNa/
+0dfCfV60uA81EextLXvpbquxLUDm9KeRqwEm2HyE9YhkEtR35NeJENmHkrC9S8K9
+URL71rPdaOdig1F/fdxyMbgfdC25/SdAIQTiWm9WizFYYPQi0cEJOiMmqZUQlMlU
++B7kdu/iOoJ7pDSBT7hdbV0nNjBoEhJymYQIVTx6700F8wIDAQABoAAwDQYJKoZI
+hvcNAQELBQADggEBAFMSsNU7dIDfw5BGXazB2PlF1Xo1PUYamjyAj5qfMyeFhGQv
+A+u4zPuSTL5ZmUWre66a4MYUMZQWNingJfCu2vDsXRrrqwEZUIaPe1VNRCbmb/p9
+h7S2qBt6beDgT6IAnijSCNKX2eLywLDd45uZulmAhKzZR6zuWRvyJjODDGqWBMLI
+Igt+syozKkhGKy13UlVD2+AsStx0K7jxbIjMrd7oVhJe8Cpv6BUs01VwIGugVR79
+AjQBNLJ9BKQXaUnzoxUQZlpvuWnDqJGjEeWLmqTLF3lDUvJCvWQV25Rejpl5Zr+1
+WKCz4kYdVZi2Hypqqntdc3q3x0dTAyWeIsnoxZY=
+-----END CERTIFICATE REQUEST-----