TiDBはMySQL互換のデータベースになるので、MySQLクライアントコマンドを用意して接続します。 （※MariaDBクライアントからでも接続可能ですが、「–ssl-mode=VERIFY_IDENTITY」などは利用出来ないので注意してください。） 今回はRocky Linux release 10.1 (Red Quartz)、MySQL8.4.8クライアントで接続を試します。
また、せかっくですので、「証明書の検証あり」の状態でアクセスをしてみます。
[root@uozu-web ~]# mysql --version mysql Ver 8.4.8 for Linux on x86_64 (Source distribution)
[root@uozu-web ~]# mysql -h xxxxxx.tidb-is1.db.sakurausercontent.com -P 3306 --ssl-mode=VERIFY_IDENTITY --ssl-ca=/etc/pki/tls/certs/ca-bundle.trust.crt -u xxxxxx -D xxxxxx -p Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 3866687745 Server version: 8.0.11-TiDB-v8.5.0 TiDB Server (Apache License 2.0) Community Edition, MySQL 8.0 compatible
Copyright (c) 2000, 2026, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> SELECT @@version; +--------------------+ | @@version | +--------------------+ | 8.0.11-TiDB-v8.5.0 | +--------------------+ 1 row in set (0.00 sec)
mysql> SHOW VARIABLES LIKE 'tls_version'; +---------------+-----------------------+ | Variable_name | Value | +---------------+-----------------------+ | tls_version | TLSv1,TLSv1.1,TLSv1.2 | +---------------+-----------------------+ 1 row in set (0.01 sec)
mysql> SHOW STATUS LIKE 'Ssl_cipher'; +---------------+-------+ | Variable_name | Value | +---------------+-------+ | Ssl_cipher | | +---------------+-------+ 1 row in set (0.02 sec)
mysql> SHOW VARIABLES LIKE '%ssl%'; +---------------+----------+ | Variable_name | Value | +---------------+----------+ | have_openssl | DISABLED | | have_ssl | DISABLED | | ssl_ca | | | ssl_cert | | | ssl_cipher | | | ssl_key | | +---------------+----------+ 6 rows in set (0.00 sec)
mysql> \s -------------- mysql Ver 8.4.8 for Linux on x86_64 (Source distribution)
Connection id: 3866687745 Current database: xxxxxx Current user: xxxxxx@133.125.237.53 SSL: Cipher in use is TLS_AES_128_GCM_SHA256 Current pager: stdout Using outfile: '' Using delimiter: ; Server version: 8.0.11-TiDB-v8.5.0 TiDB Server (Apache License 2.0) Community Edition, MySQL 8.0 compatible Protocol version: 10 Connection: xxxxxx.tidb-is1.db.sakurausercontent.com via TCP/IP Server characterset: utf8mb4 Db characterset: utf8mb4 Client characterset: utf8mb4 Conn. characterset: utf8mb4 TCP port: 3306 Binary data as: Hexadecimal Uptime: 138 days 3 hours 53 min 52 sec
Threads: 0 Questions: 0 Slow queries: 0 Opens: 0 Flush tables: 0 Open tables: 0 Queries per second avg: 0.000 --------------
mysql> show grants; +--------------------------------------------------------------------------------------------------------------------------------------+ | Grants for User | +--------------------------------------------------------------------------------------------------------------------------------------+ | GRANT USAGE ON . TO 'xxxxxx'@'%' | | GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,DROP,REFERENCES,LOCK TABLES,ALTER,INDEX,CREATE VIEW,SHOW VIEW ON xxxxxx.* TO 'xxxxxx'@'%' | +--------------------------------------------------------------------------------------------------------------------------------------+ 2 rows in set (0.00 sec)
dropped privs to tcpdump tcpdump: verbose output suppressed, use -v[v]... for full protocol decode listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
20:17:29.092750 IP uozu-web.47194 > xxx.xxx.xxx.xxx.mysql: Flags [P.], seq 420:526, ack 403, win 501, options [nop,nop,TS val 3605427310 ecr 3754115376], length 106 E.....@.@....}.5.}.G.Z....@................ ..tn..A0f....SELECT option_name, option_value FROM wp_options WHERE autoload IN ( 'yes', 'on', 'auto-on', 'auto' ) 20:17:29.093093 IP xxx.xxx.xxx.xxx.mysql > uozu-web.47194: Flags [.], ack 526, win 509, options [nop,nop,TS val 3754115379 ecr 3605427310], length 0 E..4..@.;....}.G.}.5...Z......@.....d...... ..A3..tn ～省略
[root@uozu-web ~]# tshark -i eth0 port 3306 Running as user "root" and group "root". This could be dangerous. Capturing on 'eth0' 1 0.000000000 yyy.yyy.yyy.yyy → xxx.xxx.xxx.xxx TCP 74 36568 → 3306 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=3955799525 TSecr=0 WS=128 2 0.000248765 xxx.xxx.xxx.xxx → yyy.yyy.yyy.yyy TCP 74 3306 → 36568 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1460 SACK_PERM TSval=4222735676 TSecr=3955799525 WS=128 3 0.000269746 yyy.yyy.yyy.yyy → xxx.xxx.xxx.xxx TCP 66 36568 → 3306 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=3955799525 TSecr=4222735676 4 0.002046106 xxx.xxx.xxx.xxx → yyy.yyy.yyy.yyy MySQL 156 Server Greeting proto=10 version=8.0.11-TiDB-v8.5.0 5 0.002055995 yyy.yyy.yyy.yyy → xxx.xxx.xxx.xxx TCP 66 36568 → 3306 [ACK] Seq=1 Ack=91 Win=64256 Len=0 TSval=3955799527 TSecr=4222735678 6 0.002097686 yyy.yyy.yyy.yyy → xxx.xxx.xxx.xxx MySQL 228 Login Request user=xxxxxx ～省略
