To monitor a MySQL instance that uses SSL connections, enable MySQL in SSL mode, consulting the online documentation appropriate to your deployment. 

Download the files shown below as they are required to complete this procedure:

  • ca.pem
  • server-cert.pem
  • server-key.pem
  • client-cert.pem
  • client-cert.key

Run the following commands at the command line. Substitute URLs and other information from your deployment for the placeholders in the examples.

  1. Test your local SSL connection

    mysql -h ec2-11-111-111-11.us-west-2.compute.amazonaws.com -u Testssl --ssl-ca=/etc/certs/ca.pem --ssl-cert=/etc/certs/server-cert.pem --ssl-key=/etc/certs/server-key.pem -p
    BASH

  2. Verify the remote connection

    mysql -h ec2-11-111-111-11.us-west-2.compute.amazonaws.com -u Testssl --ssl-ca=/home/appdynamics/cert/ca.pem --ssl-cert=/home/appdynamics/cert/client-cert.pem --ssl-key=/home/appdynamics/cert/client-key.pem -p
    BASH

  3. Import the ca.pem file to the default truststore 

    sudo keytool -importcert -alias MySQLCACert -file ca.pem -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit
    BASH

     

    • Do not forget the password, as you need it in step 7

  4. Convert the client key and certificate files to a PKCS #12 archive

    openssl pkcs12 -export -in client-cert.pem -inkey client-key.pem -name "mysqlclient" -passout pass:changeit -out client-keystore.p12
    BASH

  5. Import the client key and certificate into a Java keystore

    sudo keytool -importkeystore -srckeystore client-keystore.p12 -srcstoretype pkcs12 -srcstorepass changeit -destkeystore $JAVA_HOME/jre/lib/security/cacerts -deststoretype JKS -deststorepass changeit
    BASH

  6. Verify that the certificate was added

    keytool -list -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass mypassword
    BASH

  7. Start the db-agent after ensuring that the following properties are added

    /<full path to application JRE>/bin/java -jar -Djavax.net.ssl.trustStore=$JAVA_HOME/jre/lib/security/cacerts -Djavax.net.ssl.trustStorePassword=changeit -Djavax.net.ssl.keyStore=$JAVA_HOME/jre/lib/security/cacerts -Djavax.net.ssl.keyStorePassword=changeit db-agent.jar
    BASH
  8. In the Controller, create a new collector for MySQL
    • In the Configuration screen, add the connection property with Property Name "useSSL" and Property Value "true" 
    • Alternatively, you can also use the following custom connection string:

      jdbc:mysql://<RDS-Hostname>:<RDS-Port>/database?useSSL=true