3

I have found information on

  • how to install LetsEncrypt on Linux for NGINX (which works)
  • how to install LetsEncrypt for SQL Server on Windows (which relies on GUI tools so is of no use), and
  • how to install other certificates for SQL Server on Linux

but I can't find ANYTHING about LetsEncrypt for SQL Server on Linux. No matter what I try I get this error message:
Error: 49940, Severity: 16, State: 1.Unable to open one or more of the user-specified certificate file(s). Verify that the certificate file(s) exist with read permissions for the user and group running SQL Server.

It seems this should be possible, can anyone provide some tips? [Edit]
I have verified that the two LetsEncrypt files have appropriate permissions. I copied and renamed them and they are pointed to by the tlscert and tlskey keys in the network section of /var/opt/mssql/mssql.conf.

[network]
tlscert = /etc/ssl/certs/mssql.pem
tlskey = /etc/ssl/private/mssql.key
tlsprotocols = 1.2
forceencryption = 1

One thing not clear to me is whether the Letsencrypt private key in .pem format needs to be extracted to a .key file, so I have tried it both ways. I get the same error either way.
These errors show up in the mssql/log/errorlog file.
Here are the resulsts asked for

ls -l  /etc/ssl/certs/mssql.pem:
-rw------- 1 mssql mssql 3586 May  3 22:20 /etc/ssl/certs/mssql.pem
ls -l  /etc/ssl/private/mssql.key
-rw------- 1 mssql mssql 1679 May  3 22:42 /etc/ssl/private/mssql.key

mssql.pem was originally fullchain.pem and mssql.key was originally privkey.pem, which are the files required by Nginx and which work for it.

Improve this question
7
  • This would indicate that you probably have a file permission error on the file which contains the certificate. You would need to determine which file it is, and what permissions need to be. I would suggest seeing if systemctl status mysql or mysqld indicates the file, or if entering mysql at the command lines does. Failing that, you could examine /var/log to see if sql logs are there somewhere, hout journalctl -b to check those error logs.
    – Charles Green
    May 8, 2019 at 0:13
  • thanks for your questions; I have amended my original question with more details. And please note this is mssql not mysql
    – ckapilla
    May 8, 2019 at 0:47
  • K - please include the output of ls -l tlscert = /etc/ssl/certs/mssql.pem and ls -l tlskey = /etc/ssl/private/mssql.key
    – Charles Green
    May 8, 2019 at 1:02
  • please see additional edit
    – ckapilla
    May 8, 2019 at 2:17
  • 1
    Did you see this question particularly the accepted answer?
    – Charles Green
    May 8, 2019 at 3:09

1 Answer 1

Reset to default
1

Paraphrased from MariaDB SSL configuration - using Let's Encrypt certificate

The key is in the wrong format, and can be converted with openssl to different format.

openssl rsa -in ./privkey.pem -out ./privkeyrsa.pem

And after tweaking permissions (0400) and ownership of that file (mysql:mysql) SSL works as desired. (and of course config line to point to the right cert)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .