Bug #77035 mysql_ssl_rsa_setup creates client-cert.pem with incorrect CN

• Submitted: 14 May 2015 4:20
• Modified: 28 May 2015 17:41
• Reporter: Andrew Dalgleish
• Status: Closed
• Category: MySQL Server: Security: Encryption
• Severity: S2 (Serious)
• Version: 5.7.8
• OS: Any
• CPU Architecture: Any

[14 May 2015 4:20] Andrew Dalgleish

Description:
mysql_ssl_rsa_setup generates .pem files with the CN filled in, but uses the wrong CN for the client-cert.pem

How to repeat:
$ /path/to/5.7.8/bin/mysql_ssl_rsa_setup -d .
OpenSSL 1.0.1e-fips 11 Feb 2013
Generating a 2048 bit RSA private key
..................+++
......................+++
writing new private key to 'ca-key.pem'
-----
writing RSA key
Signature ok
subject=/CN=MySQL_Server_5.7.8-rc_Auto_Generated_CA_Certificate
Getting Private key
Generating a 2048 bit RSA private key
.................................+++
................+++
writing new private key to 'server-key.pem'
-----
writing RSA key
Signature ok
subject=/CN=MySQL_Server_5.7.8-rc_Auto_Generated_Server_Certificate
Getting CA Private Key
Generating a 2048 bit RSA private key
...............+++
...................+++
writing new private key to 'client-key.pem'
-----
writing RSA key
Signature ok
subject=/CN=MySQL_Server_5.7.8-rc_Auto_Generated_Server_Certificate
Getting CA Private Key
server-cert.pem: OK
client-cert.pem: OK
Generating RSA private key, 2048 bit long modulus
.........+++
.+++
e is 65537 (0x10001)
writing RSA key
$ for X in ca.pem server-cert.pem client-cert.pem; do echo $X; openssl x509 -in $X -noout -subject; done
ca.pem
subject= /CN=MySQL_Server_5.7.8-rc_Auto_Generated_CA_Certificate
server-cert.pem
subject= /CN=MySQL_Server_5.7.8-rc_Auto_Generated_Server_Certificate
client-cert.pem
subject= /CN=MySQL_Server_5.7.8-rc_Auto_Generated_Server_Certificate

Suggested fix:
client-cert.pem should say
subject= /CN=MySQL_Server_5.7.8-rc_Auto_Generated_Client_Certificate

[28 May 2015 17:41] Paul DuBois

Noted in 5.7.8, 5.8.0 changelogs.

The Common Name value written by mysql_ssl_rsa_setup to the
client-cert.pem client certificate file was
MySQL_Server_suffix_Auto_Generated_Server_Certificate rather than
MySQL_Server_suffix_Auto_Generated_Client_Certificate.