MySQL 客户端程序可以选择恢复之前的 SSL 会话,前提是服务器在其运行时缓存中有该会话。本节描述了有利于 SSL 会话重用的条件、用于管理和监控会话缓存的服务器变量,以及用于存储和重用会话数据的客户端命令行选项。MySQL client programs may elect to resume a prior SSL session, provided that the server has the session in its runtime cache. This section describes the conditions that are favorable for SSL session reuse, the server variables used for managing and monitoring the session cache, and the client command-line options for storing and reusing session data.
每次完整的 TLS 交换在计算和网络开销方面都可能很昂贵,如果使用 TLSv1.3 则开销较小。通过从已建立的会话中提取会话票证,然后在建立下一个连接时提交该票证,如果会话可以重用,则可以降低总体成本。例如,考虑具有能够打开多个连接并生成更快网页的网页的好处。Each full TLS exchange can be costly both in terms of computation and network overhead, less costly if TLSv1.3 is used. By extracting a session ticket from an established session and then submitting that ticket while establishing the next connection, the overall cost is reduced if the session can be reused. For example, consider the benefit of having web pages that can open multiple connections and generate faster.
一般来说,在可以重用 SSL 会话之前,必须满足以下条件:In general, the following conditions must be satisfied before SSL sessions can be reused:
服务器必须将其会话缓存保存在内存中。The server must keep its session cache in memory.
服务器端会话缓存的超时时间不得已过期。The server-side session cache timeout must not have expired.
每个客户端必须维护一个活动会话缓存并确保其安全。Each client has to maintain a cache of active sessions and keep it secure.
C 应用程序可以使用 C API 功能来启用加密连接的会话重用(请参阅 SSL 会话重用)。C applications can use the C API capabilities to enable session reuse for encrypted connections (see SSL Session Reuse).
为了创建初始 TLS 上下文,服务器使用上下文相关系统变量在启动时的值。为了暴露上下文值,服务器还初始化了一组对应的状态变量。下表显示了定义服务器运行时会话缓存的系统变量以及暴露当前活动会话缓存值的对应状态变量。To create the initial TLS context, the server uses the values that the context-related system variables have at startup. To expose the context values, the server also initializes a set of corresponding status variables. The following table shows the system variables that define the server's runtime session cache and the corresponding status variables that expose the currently active session-cache values.
表 8.13 会话重用的系统和状态变量Table 8.13 System and Status Variables for Session Reuse
| 系统变量名称System Variable Name | 对应的状态变量名称Corresponding Status Variable Name |
|---|---|
ssl_session_cache_mode |
Ssl_session_cache_mode |
ssl_session_cache_timeout |
Ssl_session_cache_timeout |
当 ssl_session_cache_mode 服务器变量的值为 ON(默认模式)时,Ssl_session_cache_mode 状态变量的值为 SERVER。When the value of the
ssl_session_cache_mode server
variable is ON, which is the default mode,
the value of the
Ssl_session_cache_mode
status variable is SERVER.
SSL 会话缓存变量适用于 mysql_main 和 mysql_admin TLS 通道。它们的值也会在 Performance Schema 的 tls_channel_status 表中作为属性显示,同时显示任何其他活动 TLS 上下文的属性。SSL session cache variables apply to both the
mysql_main and mysql_admin
TLS channels. Their values are also exposed as properties in the
Performance Schema
tls_channel_status table, along
with the properties for any other active TLS contexts.
要在运行时重新配置 SSL 会话缓存,请使用以下步骤:To reconfigure the SSL session cache at runtime, use this procedure:
将每个应更改的缓存相关系统变量设置为其新值。例如,将缓存超时时间从默认值(300 秒)更改为 600 秒:Set each cache-related system variable that should be changed to its new value. For example, change the cache timeout value from the default (300 seconds) to 600 seconds:
mysql>
SET GLOBAL ssl_session_cache_timeout = 600;由于重新配置过程的工作方式,每对系统变量和状态变量的成员可能会暂时具有不同的值。The members of each pair of system and status variables may have different values temporarily due to the way the reconfiguration procedure works.
mysql>
SHOW VARIABLES LIKE 'ssl_session_cache_timeout';+---------------------------+-------+ | Variable_name | Value | +---------------------------+-------+ | ssl_session_cache_timeout | 600 | +---------------------------+-------+ 1 row in set (0.00 sec) mysql>SHOW STATUS LIKE 'Ssl_session_cache_timeout';+---------------------------+-------+ | Variable_name | Value | +---------------------------+-------+ | Ssl_session_cache_timeout | 300 | +---------------------------+-------+ 1 row in set (0.00 sec)有关设置变量值的更多信息,请参阅 系统变量赋值。For additional information about setting variable values, see System Variable Assignment.
执行
ALTER INSTANCE RELOAD TLS。该语句根据当前缓存相关系统变量的值重新配置活动的 TLS 上下文。同时,它还设置缓存相关状态变量以反映新的活动缓存值。该语句需要CONNECTION_ADMIN权限。ExecuteALTER INSTANCE RELOAD TLS. This statement reconfigures the active TLS context from the current values of the cache-related system variables. It also sets the cache-related status variables to reflect the new active cache values. The statement requires theCONNECTION_ADMINprivilege.mysql>
ALTER INSTANCE RELOAD TLS;Query OK, 0 rows affected (0.01 sec) mysql>SHOW VARIABLES LIKE 'ssl_session_cache_timeout';+---------------------------+-------+ | Variable_name | Value | +---------------------------+-------+ | ssl_session_cache_timeout | 600 | +---------------------------+-------+ 1 row in set (0.00 sec) mysql>SHOW STATUS LIKE 'Ssl_session_cache_timeout';+---------------------------+-------+ | Variable_name | Value | +---------------------------+-------+ | Ssl_session_cache_timeout | 600 | +---------------------------+-------+ 1 row in set (0.00 sec)在执行
ALTER INSTANCE RELOAD TLS后建立的新连接将使用新的 TLS 上下文。现有连接不受影响。New connections established after execution ofALTER INSTANCE RELOAD TLSuse the new TLS context. Existing connections remain unaffected.
所有 MySQL 客户端程序都能够在对同一服务器建立新的加密连接时重用之前的会话,前提是您在原始连接仍然活跃时已经存储了会话数据。会话数据会存储到一个文件中,并且在再次调用客户端时需要指定该文件。All MySQL client programs are capable of reusing a prior session for new encrypted connections made to the same server, provided that you stored the session data while the original connection was still active. Session data are stored to a file and you specify this file when you invoke the client again.
要存储和重用 SSL 会话数据,请使用以下步骤:To store and reuse SSL session data, use this procedure:
调用 mysql 来建立与运行 MySQL 8.4 服务器的加密连接。Invoke mysql to establish an encrypted connection to a server running MySQL 8.4.
使用 ssl_session_data_print 命令指定一个文件路径,在该文件中可以安全地存储当前活动的会话数据。例如:Use the ssl_session_data_print command to specify the path to a file where you can store the currently active session data securely. For example:
mysql>
ssl_session_data_print ~/private-dir/session.txt会话数据以空字符终止的 PEM 编码 ANSI 字符串形式获得。如果省略路径和文件名,字符串将打印到标准输出。Session data are obtained in the form of a null-terminated, PEM encoded ANSI string. If you omit the path and file name, the string prints to standard output.
从命令解释器的提示符中,调用任何 MySQL 客户端程序以建立到相同服务器的新加密连接。要重用会话数据,请指定
--ssl-session-data命令行选项及文件参数。From the prompt of your command interpreter, invoke any MySQL client program to establish a new encrypted connection to the same server. To reuse the session data, specify the--ssl-session-datacommand-line option and the file argument.例如,使用 mysql 建立新连接:For example, establish a new connection using mysql:
mysql -u admin -p --ssl-session-data=~/private-dir/session.txt
然后使用 mysqlshow 客户端:and then mysqlshow client:
mysqlshow -u admin -p --ssl-session-data=~/private-dir/session.txt Enter password: ***** +--------------------+ | Databases | +--------------------+ | information_schema | | mysql | | performance_schema | | sys | | world | +--------------------+
在每个示例中,客户端在建立与同一服务器的新连接时尝试恢复原始会话。In each example, the client attempts to resume the original session while it establishes a new connection to the same server.
要确认 mysql 是否重用了会话,请查看
status命令的输出。如果当前活动的 mysql 连接确实恢复了会话,状态信息将包含SSL session reused: true。To confirm whether mysql reused a session, see the output from thestatuscommand. If the currently active mysql connection did resume the session, the status information includesSSL session reused: true.
除了 mysql 和 mysqlshow,SSL 会话重用还适用于 mysqladmin、mysqlbinlog、mysqlcheck、mysqldump、mysqlimport、mysqlslap、mysqltest、mysql_migrate_keyring 和 mysql_secure_installation。In addition to mysql and mysqlshow, SSL session reuse applies to mysqladmin, mysqlbinlog, mysqlcheck, mysqldump, mysqlimport, mysqlslap, mysqltest, mysql_migrate_keyring, and mysql_secure_installation.
有几种情况可能会阻止会话数据的成功检索。例如,如果会话未完全连接、它不是 SSL 会话、服务器尚未发送会话数据,或者 SSL 会话根本不可重用。即使会话数据已正确存储,服务器的会话缓存也可能会超时。无论原因如何,如果你指定了 --ssl-session-data 但会话无法重用,默认会返回错误。例如:Several conditions may prevent the successful retrieval of
session data. For instance, if the session is not fully
connected, it is not an SSL session, the server has not yet sent
the session data, or the SSL session is simply not reusable.
Even with properly stored session data, the server's session
cache can time out. Regardless of the cause, an error is
returned by default if you specify
--ssl-session-data but the
session cannot be reused. For example:
mysqlshow -u admin -p --ssl-session-data=~/private-dir/session.txt Enter password: ***** ERROR: --ssl-session-data specified but the session was not reused.
要抑制错误消息,并通过静默创建新会话来建立连接,请在命令行中指定 --ssl-session-data-continue-on-failed-reuse,同时指定 --ssl-session-data。如果服务器的缓存超时已过,您可以将会话数据再次存储到同一文件中。默认的服务器缓存超时可以延长(参见 SSL 会话重用的服务器端运行时配置和监控)。To suppress the error message, and to establish the connection
by silently creating a new session instead, specify
--ssl-session-data-continue-on-failed-reuse
on the command line, along with
--ssl-session-data . If the
server's cache timeout has expired, you can store the session
data again to the same file. The default server cache timeout
can be extended (see
Server-Side Runtime Configuration and Monitoring for SSL Session Reuse).