I have my MySQL database set up to require server and client identify verification, with both presenting their certificates signed by the same CA (mysql user was set up with 'require X509').

Question: which certificate/key is used in the SSL handshake to securely exchange the symmetric key that establishes the encrypted tunnel for all subsequent communication? The CA certificate/key, the server certificate/key, or the client certificate/key?

Assuming that the server key is 2048 bits, the CA 3072 bits, but the symmetric key between server and client is exchanged using the server key, that will then be on a slightly lower security level compared to the CA key being used.

  • Unless you're using RSA only key exchange, the answer as you asked it is none of them (otherwise, that of the device receiving the connection request, the server). They more probably use Diffie-Hellman, either the standard version or the ECC version. The DH parameters are then signed using those public keys in the certificates to prove who each party is (the client signs with his client cert, server signs with its server cert, and the server shows the CA signed his cert too). – Natanael Nov 19 '15 at 22:48
  • All keys involved are RSA only, and in SSL the symmetric key is then exchanged by being encrypted with an RSA key. – azenz Nov 20 '15 at 6:44
  • Please list the cipher suites in use – Natanael Nov 20 '15 at 10:48
  • DHE-RSA-AES256-SHA. But all of the keys involved in the process are RSA keys. – azenz Nov 20 '15 at 12:19
  • All the STATIC keys are RSA. But not all key material. DHE means the client and server both creates NEW random key material that they then delete afterwards, and they both RSA sign the public components of that key material. RSA is here not used for any kind of encryption, only authentication. DHE creates the session AES256 key. – Natanael Nov 20 '15 at 13:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.