MySQL的SSL SSL连接证书validation失败

我已经按照以下步骤在服务器A上添加了mysql ssl支持：

# Generate a CA key and certificate with SHA1 digest openssl genrsa 2048 > ca-key.pem openssl req -sha1 -new -x509 -nodes -days 3650 -key ca-key.pem > ca-cert.pem # Create server key and certficate with SHA1 digest, sign it and convert # the RSA key from PKCS #8 (OpenSSL 1.0 and newer) to the old PKCS #1 format openssl req -sha1 -newkey rsa:2048 -days 730 -nodes -keyout server-key.pem > server-req.pem openssl x509 -sha1 -req -in server-req.pem -days 730 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-cert.pem openssl rsa -in server-key.pem -out server-key.pem # Create client key and certificate with SHA digest, sign it and convert # the RSA key from PKCS #8 (OpenSSL 1.0 and newer) to the old PKCS #1 format openssl req -sha1 -newkey rsa:2048 -days 730 -nodes -keyout client-key.pem > client-req.pem openssl x509 -sha1 -req -in client-req.pem -days 730 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > client-cert.pem openssl rsa -in client-key.pem -out client-key.pem 

服务器一个 nano /etc/mysql/my.cnf

 bind-address = 0.0.0.0 [client] ssl-ca=/etc/mysql/ca-cert.pem [mysqld] ssl-ca=/etc/mysql/ca-cert.pem ssl-cert=/etc/mysql/server-cert.pem ssl-key=/etc/mysql/server-key.pem 

并testingSSL支持

 mysql -u root -p mysql> show variables like "%ssl%"; This is resoult from my ubuntu 14.04 test machine mysql> show variables like "%ssl%"; +---------------+----------------------------+ | Variable_name | Value | +---------------+----------------------------+ | have_openssl | YES | | have_ssl | YES | | ssl_ca | /etc/mysql/ca-cert.pem | | ssl_capath | | | ssl_cert | /etc/mysql/server-cert.pem | | ssl_cipher | | | ssl_crl | | | ssl_crlpath | | | ssl_key | /etc/mysql/server-key.pem | +---------------+----------------------------+ 9 rows in set (0.00 sec) 

服务器B nano /etc/mysql/my.cnf

• 无法访问mysql docker
• 后缀 – 允许发送电子邮件与相关的别名
• PHP高CPU使用率
• 意外的mysql -urootauthentication
• 为什么php5-fpm只有在多个wordpress网站处于活动状态时才能执行？

 [client] ssl-ca=/etc/mysql/ca-cert.pem ssl-cert=/etc/mysql/client-cert.pem ssl-key=/etc/mysql/client-key.pem 

服务器B：我正在testing的PHP脚本：

 $con=mysqli_init(); if (!$con){ die("mysqli_init failed"); } mysqli_ssl_set($con, "/var/www/certs/client-key.pem","/var/www/certs/client-cert.pem","/var/www/certs/ca-cert.pem",NULL, "AES256-SHA"); if (!mysqli_real_connect( $con,"127.0.0.1","user", 'password',"db", 3306)){ die("Connect Error: " . mysqli_connect_error()); } mysqli_close($con); 

我得到的错误：

 PHP Warning: mysqli_real_connect(): SSL operation failed with code 1. OpenSSL Error messages: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed in ... 

我在服务器B上运行php脚本，而mysql db在服务器A上。

当我尝试通过控制台从服务器B连接到A它连接。 码：

 mysql -h SERVER_A_IP -P 3306 -uuser -ppassword