Configuring a SSL Connection for the MySQL agent (4232477)

This article outlines the steps required to configure an encrypted SSL connection between the MySQL Agent and a MySQL server. It assumes basic familiarity with SSL certificates and Java keystore tools.

To enable SSL, the MySQL server must be compiled with OpenSSL or yaSSL and properly configured to support encrypted connections. If certificates are missing or improperly formatted, the agent will fail to establish a secure connection.

1. Verify SSL Support on MySQL Server

SHOW VARIABLES LIKE 'have_ssl';

If the result is YES, SSL is supported. If DISABLED, start the server with appropriate SSL options and generate required certificates.

2. Prepare Client Certificates

• Locate client-cert.pem and ca.pem in the MySQL data directory.
• Convert the client certificate to DER format:

openssl x509 -outform DER -in client-cert.pem -out client.cert

3. Import Certificates into FglAM

Use the bundled keytool located in [FGLAM_HOME]\jre.8.0.72\jrein or equivalent:

keytool.exe -import -file client.cert -keystore ..\..\..\..\keystore -alias mysqlClientCertificate
keytool.exe -import -file ca.pem -keystore ..\lib\security\cacerts -alias mysqlServerCACert
    

Default keystore password is changeit.

To preserve the truststore across upgrades, copy cacerts to a custom location (e.g., [FGLAM_HOME] \truststore).

4. Configure JVM Parameters

Edit baseline.jvmargs.config in [FGLAM_HOME]\state\default\config:

vmparameter.0 = "-Djavax.net.ssl.keyStore="C:/Foglight Agent Manager/keystore"";
vmparameter.1 = "-Djavax.net.ssl.keyStorePassword=changeit";
vmparameter.2 = "-Djavax.net.ssl.trustStore="C:/Foglight Agent Manager/truststore/cacerts"";
vmparameter.3 = "-Djavax.net.ssl.trustStorePassword=changeit";

5. Restart FglAM

Restart the Foglight Agent Manager to apply the new SSL configuration.

6. Configure Agent Properties

Set Use SSL to true in the MySQL Agent configuration.

• Refer to the Using Secure Connections section of the MySQL documentation for your version.
• The default truststore (cacerts) includes many well-known CA certificates.
• Using -Djavax.net.ssl.trustStore overrides the default JRE truststore.
• To add more CA certificates, import them into cacerts and copy it to a custom location.