正如 Charley 所指出的,我认为 .csr 文件是错误的——我在尝试关注同一篇文章时遇到了同样的问题(并且遇到了同样的错误)。我按照这篇文章(https://dev.mysql.com/doc/refman/5.0/en/creating-ssl-certs.html)生成密钥和证书,并且有效。要点:
# Create CA certificate
shell> openssl genrsa 2048 > ca-key.pem
shell> openssl req -new -x509 -nodes -days 3600 \
-key ca-key.pem -out ca-cert.pem
# Create server certificate, remove passphrase, and sign it
# server-cert.pem = public key, server-key.pem = private key
shell> openssl req -newkey rsa:2048 -days 3600 \
-nodes -keyout server-key.pem -out server-req.pem
shell> openssl rsa -in server-key.pem -out server-key.pem
shell> openssl x509 -req -in server-req.pem -days 3600 \
-CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem
# Create client certificate, remove passphrase, and sign it
# client-cert.pem = public key, client-key.pem = private key
shell> openssl req -newkey rsa:2048 -days 3600 \
-nodes -keyout client-key.pem -out client-req.pem
shell> openssl rsa -in client-key.pem -out client-key.pem
shell> openssl x509 -req -in client-req.pem -days 3600 \
-CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out client-cert.pem
然后 ca-cert.pem 两边都是 ssl-ca,服务器获取 ssl-cert 和 ssl-key 的 server-[key/cert].pem,客户端获取客户端的。