Establishing SSL with MariaDB10 on Synology

Can anyone please point me to a solution for enabling SSL connections for MariaDB10 on a Synology device?

The device is a Synology NAS running DSM 7.0.1 (Update 2).

I have:

1. Created the recommended certificates (ca-key.pem / server-key.pem / server-cert.pem) via:

openssl genrsa -out ca-key.pem 2048
    
openssl req -new -x509 -nodes -days 365000 -key ca-key.pem -out ca-cert.pem
    
openssl req -newkey rsa:2048 -days 365 -nodes -keyout server-key.pem
    -out server-req.pem
    
openssl rsa -in server-key.pem -out server-key.pem
    
openssl x509 -req -in server-req.pem -days 365 -CA ca-cert.pem -CAkey ca-key.pem set_serial 01 -out server-cert.pem

2. Placed certificates in the '/etc/mariadb/' directory

3. edited the my.cnf file (ie. '/var/packages/MariaDB10/etc/my.cnf') to include the following:

[mysqld]
ssl
ssl-capath=/etc/mariadb/
ssl-ca=ca-cert.pem
ssl-cert=server-cert.pem
ssl-key=server-key.pem
#require_secure_transport=ON #see note below regarding Synology error

Note: the use of require_secure_transport=ON produces an error in the Synology Package center stating 'Failed to start "MariaDB10"...'

4. Restart MariaDB

5. MariaDB10 provides the following responses for show variables like '%ssl%'

have_openssl    YES
have_ssl        DISABLED
ssl_ca          ca-cert.pem
ssl_capath      /etc/mariadb/
ssl_cert        server-cert.pem
ssl_key         server-key.pem

Likely the MariaDB for Synology hasn't been compiled with support for SSL, and that is why it doesn't work.

I wouldn't bother with MariaDB SSL. It is better to use SSH tunneling to connect to SQL servers remotely.

First open the tunnel with:

ssh -L 3306:127.0.0.1:3306 [email protected]

And then connect to it:

mysql -h localhost ...