Skip SSL certificate generation

[fvasco]

I use MySQL for local test, on each startup MySQL take some time to generate a random SSL certificate.

Is it possible to skip the SSL certificate generation?

[tianon]

Hmm, this is an interesting point -- we don't have a way to skip the mysql_ssl_rsa_setup line easily.

We do check whether the command exists, so you could use that to work around the issue:

FROM mysql:5.7
RUN rm -v "$(which mysql_ssl_rsa_setup)"

Or even hackier:

$ docker run ... -v /dev/null:/usr/bin/mysql_ssl_rsa_setup ... mysql:5.7

[tianon]

Just to be clear, the section of code under discussion is the following:

mysql/5.7/docker-entrypoint.sh

Lines 93 to 100 in 30bf2b7

	if command -v mysql_ssl_rsa_setup > /dev/null && [ ! -e "$DATADIR/server-key.pem" ]; then
	# https://github.com/mysql/mysql-server/blob/23032807537d8dd8ee4ec1c4d40f0633cd4e12f9/packaging/deb-in/extra/mysql-systemd-start#L81-L84
	echo 'Initializing certificates'
	mysql_ssl_rsa_setup --datadir="$DATADIR"
	echo 'Certificates initialized'
	fi

[fvasco]

I seen that, your solution should work well, but maintain a MySQL image only for testing purpose is an extra cost.

Is it possible to add an environment variable like MYSQL_INITDB_SKIP_TZINFO?

Another interesting solution is the variable MYSQL_SERVER_KEY_PEM, so it is possible declare the certificate to use or -optionally- turn off SSL.

[scara]

Hello,
my +1 to an env var approach (whatever), keeping care to disable any mounted certificate by explicitly passing --ssl=0 too (#256), just in case.

In the mean time I'm playing w/ the 1st work around described above.

TIA,
Matteo

[tianon]

Took a different approach over in #428 -- basically, if SSL is disabled, we skip the certificate generation (which is exactly what 8.0's initialization scripts seem to do as well).

[inieves]

@tianon

I propose #428 is a less than ideal solution.

The use case is: The user has their own certificates/credentials they wan't to supply to mysql AND they don't want to spend time generating new credentials which will never be used. So the user wants to turn off automatic generation of credentials BUT they do not want to turn off SSL.

[tianon]

If the user supplies their own certificates in the appropriate place, MySQL should transparently pick them up and should not create new ones. If that behavior is not working, then we should look at fixing that separately.

[tianon]

With the solution in #428, I'm considering this closed and fixed.

If you wish to not have the image generate SSL certificates, you have two choices:

1. supply --ssl=0 (this disables SSL in MySQL entirely, which may or may not be what you want)

2. supply /var/lib/mysql/server-key.pem (which will disable the invocation of mysql_ssl_rsa_setup, thus not generating new keys)