Why does MySQL replication use five certificates?

Question

Hello everyone!

I'm attempting to set up MySQL replication with SSL encryption, and while I'm beginning to close in on the solution, there's one aspect of the process that I can't wrap my brain around relating to the way MySQL uses SSL.

According to the documentation on MySQL 5.0 (setting up SSL for client/server and setting up SSL for replication), the SSL connection can involve up to five pieces of information: the CA cert, the master's signed public and private keys, and the slave's signed public and private keys. What I don't understand is the need for these five components. My understanding of SSL (gleaned from the Wikipedia entry) is that SSL generally requires only three pieces: the CA certificate (shared by server and client), the server's public key (sent to the client, validated against the CA cert, and used to encrypt / decrypt communication to the server), and the server's private key (kept by the server and use to encrypt / decrypt communication to client).

So why in the MySQL replication SSL solution does the slave also have a public/private key pair signed against the same CA cert as the master's public/private key pair?

Answer 1

Both sides of the replication link have to deem the other end trustworthy.

Answer 2

Actually that's only three certificates. However each SSL certificate comprises two keys - the public key and the private key.

The server and the client can each use the fact that the other party's public key has been signed by the CA's private key to prove to each other that they're who they say they are.

The CA itself also has a public key and a private key, but in the case where you've obtained the SSL certificates from a third party you never get to see their private key.

Answer 3

This is for mutual authentication. The slave needs to prove to the master its identity and the master needs to prove its identity to the slave.

Edit: A certificate only contains a public key. (The private key is stored in the machine's Cryptographic Service Provider (CSP).) It's therefore 5 keys, and 3 certificates.