Enabling TLS 1.2 for MariaDB Database Server

TLS 1.2 encrypts the connection between the MariaDB server and the Cloudera Manager server. You must enable TLS 1.2 for the MariaDB database before setting up Cloudera Manager and add the MariaDB root Certificate Authorities (CA) to the Cloudera Manager truststore.

SSH into the MariaDB database host.
Start the MariaDB server:
```
service mysqld start
```
Establish an encrypted connection with the client:
```
mysql -p --ssl=true
```
Verify whether TLS 1.2 is enabled on MariaDB by running the following command:
```
mysql> show global variables like '%ssl%';
```
If TLS 1.2 is enabled, you see the value of have_ssl equal to YES, as follows. Otherwise, you see the value of have_ssl equal to DISABLED:
```
+---------------+----------+
| Variable_name | Value    |
+---------------+----------+
| have_openssl  | YES      |
| have_ssl      | YES      |
| ...           | ...      | 
```
If TLS 1.2 is enabled, then you can skip the following steps and go to Importing the MariaDB root certificate.

Create a certificate authority by running the following commands:

mkdir /etc/my.cnf.d/ssl/
cd /etc/my.cnf.d/ssl/  
openssl genrsa 2048 > ca-key.pem

Create a certificate for the server using the CA certificate generated earlier by running the following command:

openssl req -new -x509 -nodes -days 365000 -key ca-key.pem -out ca-cert.pem
openssl req -newkey rsa:2048 -days 365 -nodes -keyout server-key.pem -out server-req.pem
openssl rsa -in server-key.pem -out server-key.pem

Create a certificate for the clients using the same CA certificate by running the following command:

openssl x509 -req -in server-req.pem -days 365 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem

Add the following lines in the /etc/my.cnf.d/server.cnf file under the [mysqld] section:
```
ssl-ca=/etc/my.cnf.d/ssl/ca-cert.pem
ssl-cert=/etc/my.cnf.d/ssl/server-cert.pem
ssl-key=/etc/my.cnf.d/ssl/server-key.pem
bind-address=*
```
You can view the content of the server.cnf file by running the following command:
```
vim /etc/my.cnf.d/server.cnf
```

Run the following commands to change the permission and ownership of the server-key.pem file:

sudo chown mysql:mysql /etc/my.cnf.d/ssl/server-key.pem
sudo chmod 600 /etc/my.cnf.d/ssl/server-key.pem

Restart the MariaDB server:
```
service mysqld restart
```

Check the TLS 1.2 status by running the following commands:

mysql -p --ssl=true
> SHOW VARIABLES LIKE '%ssl%';
> status

Sample output:

> SHOW VARIABLES LIKE '%ssl%';
+---------------------+-----------------------------------+
| Variable_name       | Value                             |
+---------------------+-----------------------------------+
| have_openssl        | YES                               |
| have_ssl            | YES                               |
| ssl_ca              | /etc/my.cnf.d/ssl/ca-cert.pem     |
| ssl_capath          |                                   |
| ssl_cert            | /etc/my.cnf.d/ssl/server-cert.pem |
| ssl_cipher          |                                   |
| ssl_crl             |                                   |
| ssl_crlpath         |                                   |
| ssl_key             | /etc/my.cnf.d/ssl/server-key.pem  |
| version_ssl_library | OpenSSL 1.0.2k-fips  26 Jan 2017  |
+---------------------+-----------------------------------+

> status
SSL:			Cipher in use is DHE-RSA-AES256-GCM-SHA384