Skip certificate generation if SSL is disabled

[tianon]

Closes #379

[tianon]

@ltangvald I was testing this and found that in 8.0, it appears that --initalize-insecure is creating a certificate itself if SSL is enabled -- should we remove this bit of code entirely from 8.0? (or are there cases where SSL is enabled and --initalize-insecure doesn't create a server-key.pem file?)

[tianon]

Friendly ping @ltangvald ❤️

[tianon]

Friendly ping @ltangvald 😉

I was testing this and found that in 8.0, it appears that --initalize-insecure is creating a certificate itself if SSL is enabled -- should we remove this bit of code entirely from 8.0? (or are there cases where SSL is enabled and --initalize-insecure doesn't create a server-key.pem file?)

[inieves]

I propose this is a less than ideal solution.

The use case is: The user has their own certificates/credentials they wan't to supply to mysql AND they don't want to spend time generating new credentials which will never be used. So the user wants to turn off automatic generation of credentials BUT they do not want to turn off SSL.

[tianon]

#379 (comment)

If the user supplies their own certificates in the appropriate place, MySQL should transparently pick them up and should not create new ones. If that behavior is not working, then we should look at fixing that separately.

[tianon]

Rebased/updated to the new docker-entrypoint.sh structure

[ltangvald]

I think the separate mysql_ssl_rsa_setup utility was mostly just relevant before we started linking openssl (for licensing issues), so this may no longer be needed for any versions? Also, this behavior can be controlled with the auto_generate_certs and sha256_password_auto_generate_rsa_keys settings. So by virtue of me being over 2 years late cough, I think this probably isn't needed any more :)

[tianon]

So if I'm understanding correctly, this change should be updated to the following, even on MySQL 5.6?

diff --git a/.template.Debian/docker-entrypoint.sh b/.template.Debian/docker-entrypoint.sh
index 6845ee4..6024a90 100755
--- a/.template.Debian/docker-entrypoint.sh
+++ b/.template.Debian/docker-entrypoint.sh
@@ -163,13 +163,6 @@ docker_init_database_dir() {
 		"$@" --initialize-insecure
 	fi
 	mysql_note "Database files initialized"
-
-	if command -v mysql_ssl_rsa_setup > /dev/null && [ ! -e "$DATADIR/server-key.pem" ]; then
-		# https://github.com/mysql/mysql-server/blob/23032807537d8dd8ee4ec1c4d40f0633cd4e12f9/packaging/deb-in/extra/mysql-systemd-start#L81-L84
-		mysql_note "Initializing certificates"
-		mysql_ssl_rsa_setup --datadir="$DATADIR"
-		mysql_note "Certificates initialized"
-	fi
 }
 
 # Loads various settings that are used elsewhere in the script

[ltangvald]

Right. Just need to verify that the resulting datadir is the same. For 5.6 I don't think that block does anything, since it doesn't have this functionality or mysql_ssl_rsa_setup.

[tianon]

Updated with the removal of the mysql_ssl_rsa_setup code, and verified on 8.0 and 5.7 that certificates are still generated into /var/lib/mysql.

8.0:

$ docker exec -it test sh -c 'ls -l /var/lib/mysql/*.pem'
-rw------- 1 mysql mysql 1676 Nov 20 22:21 /var/lib/mysql/ca-key.pem
-rw-r--r-- 1 mysql mysql 1112 Nov 20 22:21 /var/lib/mysql/ca.pem
-rw-r--r-- 1 mysql mysql 1112 Nov 20 22:21 /var/lib/mysql/client-cert.pem
-rw------- 1 mysql mysql 1680 Nov 20 22:21 /var/lib/mysql/client-key.pem
-rw------- 1 mysql mysql 1680 Nov 20 22:21 /var/lib/mysql/private_key.pem
-rw-r--r-- 1 mysql mysql  452 Nov 20 22:21 /var/lib/mysql/public_key.pem
-rw-r--r-- 1 mysql mysql 1112 Nov 20 22:21 /var/lib/mysql/server-cert.pem
-rw------- 1 mysql mysql 1676 Nov 20 22:21 /var/lib/mysql/server-key.pem

5.7:

$ docker exec -it test sh -c 'ls -l /var/lib/mysql/*.pem'
-rw------- 1 mysql mysql 1676 Nov 20 22:22 /var/lib/mysql/ca-key.pem
-rw-r--r-- 1 mysql mysql 1112 Nov 20 22:22 /var/lib/mysql/ca.pem
-rw-r--r-- 1 mysql mysql 1112 Nov 20 22:22 /var/lib/mysql/client-cert.pem
-rw------- 1 mysql mysql 1680 Nov 20 22:22 /var/lib/mysql/client-key.pem
-rw------- 1 mysql mysql 1680 Nov 20 22:22 /var/lib/mysql/private_key.pem
-rw-r--r-- 1 mysql mysql  452 Nov 20 22:22 /var/lib/mysql/public_key.pem
-rw-r--r-- 1 mysql mysql 1112 Nov 20 22:22 /var/lib/mysql/server-cert.pem
-rw------- 1 mysql mysql 1676 Nov 20 22:22 /var/lib/mysql/server-key.pem

[tianon]

I also verified with --ssl=0.

8.0:

$ docker exec -it test sh -c 'ls -l /var/lib/mysql/*.pem'
-rw------- 1 mysql mysql 1680 Nov 20 22:23 /var/lib/mysql/private_key.pem
-rw-r--r-- 1 mysql mysql  452 Nov 20 22:23 /var/lib/mysql/public_key.pem

5.7:

$ docker exec -it test sh -c 'ls -l /var/lib/mysql/*.pem'
-rw------- 1 mysql mysql 1680 Nov 20 22:23 /var/lib/mysql/private_key.pem
-rw-r--r-- 1 mysql mysql  452 Nov 20 22:23 /var/lib/mysql/public_key.pem

[yosifkit]

This seems fine. Is it safe to merge?