Can not set an SSL Connection to MysqlServer using MySSLIOhandler

chihebbs · Post by **chihebbs** » Sat 15 Dec 2007 20:19

When ever I try to connect using MySSLIOHandler i get the following Error : If a certificate is specified it must have a private key. I use the ScFileStorage for the certificates and the keys

I have both the client certificate and the key and the CA certificate. Mysql is set to connect with the same CA certificate. the client certificate is signed by the same CA.

Myconnection protocol is set to mpSSL and no SSl options are set.

My first aim of using SecureBridge is to stop using external libraries of OpenSSL

Windows XP Sp 2 Mysql 5.0.45 code gear 2007 SecureBridge 2.00 Mydac 5.20.0.12.

Please advice, a more detailed step by step tutorial is very welcome.
Thanks in advance

Dimon · Post by **Dimon** » Mon 17 Dec 2007 09:24

You can find the detailed information about MySSLIOHandler settings in the SecireBridge help.

Also you need to make sure, that the key of the client certificate is private. To make a key of a client certificate private, perform the next steps:
1. Open the editor of the storage component by double click on it, and select the Certificates tab.
2. Choose the client certificate.
3. Import information from a file that contains a client key by using the "Import key from..." button.
At run-time you can use the TScCertificate.Key.ImportFrom method.

chihebbs · Post by **chihebbs** » Mon 17 Dec 2007 13:57

But I do not want to use any Client certificate. I just want to use a CA certificate, which of course I dont have any private key.

I want to check the connection is established in design time.

When not providing a client certificate I get the following error : certificate not found.

Thank you in advance for your help.

Dimon · Post by **Dimon** » Mon 17 Dec 2007 15:08

In order to solve this problem, apply the following change.
Find and delete the line below in the TMySSLIOHandler.Connect method of the MySSLIOHandler.pas unit:

Code: Select all

SSLClient.Storage.Certificates.CertificateByName(SSLClient.CertName).Ready := True;

chihebbs · Post by **chihebbs** » Mon 17 Dec 2007 19:30

Applying the mentionned change solved the problem with a connection not using a client certificate.

At run-time and using the TScCertificate.Key.ImportFrom method, the connection is established as expected using client certificate and private key.

But the problem still persists in Design time, even though the certificate and the private key are in the same folder, ScFileStorage with Path property set to the folder containing the Client certificate and private key : I always get the same Error : If a certificate is specified it must have a private key.

Thank you in advance for any help.

Dimon · Post by **Dimon** » Tue 18 Dec 2007 14:10

TScFileStorage does not save certificate links to private keys.
Use TScCryptoAPIStorage if you want to keep a private key link of a certificate.

chihebbs · Post by **chihebbs** » Tue 18 Dec 2007 21:36

Thank you for the answer.