I have a mail server with a MySQL database back-end. The mail server and MySQL DB are both installed on the same Windows machine. Is there any benefit to using SSL connections between the two applications on localhost?
I think the connection is using TCP and not local sockets.
Based on this question about SSL on a trusted LAN, I don't think there is any benefit for local connections. It seems like an attacker would have to be on the machine to read the traffic, and if attackers can get on our machine they can probably get whatever they want. But this setup was already using SSL when I joined the team. I performed a MySQL upgrade and now I'm having trouble with the SSL connection. I'm wondering if I would be correct to convince the team that we don't need SSL on localhost anyway.
If you don't have other users on this machine you might be right. If you have other accounts with the ability to connect from remote they might be compromised. If the attacker is able to completely own the machine you are busted anyway. But even if the attacker cannot get root he might be able to make mysqld crash and then take over the port (default port is 3306 which does not need special permissions). In this way using SSL could help a bit, because the identity of the (hackers) server cannot be verified.
To prevent the data stream from being decoded by an attacker listening on the network; and
To ensure to the client that he is connecting to the authentic server, and not a man-in-the-middle.
The first function is not necessary on localhost, because in order to listen to the stream, the attacker would had to have broken into your system already. This is true on Windows as well as other OS's.
The second function is possible only if the client is connecting to the server by its fully-qualified domain name, because anyone (or no one) can get a certificate for "localhost".