Add ssl=on parameter to mysql plugin.

[dotmitsu]

We use mariadb and strongswan sql plugin for connecting to DB. https://docs.strongswan.org/docs/5.9/plugins/sql.html
We need to use ssl encrypted connection but can't because sql plugin doesn't have this parameter.
Please add this parameter. It will be like:

charon {
  plugins {
    sql {
      database = mysql://user:pass@localhost/database?ssl=on
    }
  }
}

[straystreyk]

+1

[PashaShredder]

That's an important aspect, I'm all for it

[strongX509]

Well, you are free to add ?ssl=on to the mysql URI. Is strongSwan supposed to negotiate a TLS-protected connection? It doesn't make make sense for localhost.

[dotmitsu]

Our mariadb is on another host. We use a few strongswan on different hosts with one mariadb database. ssl=on doesn't work for strongswan plugin. This plugin doesn't support ssl connection to mariadb. If we turn off encrypted connection on mariadb and use unencrypted connection, everithing works in strongswan plugin.

[Thermi]

Well, you are free to add ?ssl=on to the mysql URI. Is strongSwan supposed to negotiate a TLS-protected connection? It doesn't make make sense for localhost.

strongswan needs to handle the URL parameter by doing this if it is found: https://dev.mysql.com/doc/c-api/8.3/en/c-api-encrypted-connections.html

[Thermi]

I think in the meantime you can try working with stunnel