QuestionQ145

Database Security

Examine the following configuration:

  • You have a corporate private network that uses its own Certificate Authority (CA) with an industry-standard 2048-bit RSA key length.
  • All MySQL Server and client certificates are signed by the central corporate CA.
  • All clients are known, controlled, and reside only on the private LAN.
  • The private network uses its own private authoritative DNS.
  • The private network also uses other nominal enterprise services.
  • An end-to-end encrypted connection between a MySQL client and MySQL server has been established on this LAN.

How does the MySQL Server’s self-signed certificate compare with one signed by a known public, third-party trusted Certificate Authority?

  • A The self-signed certificate is less secure and equally trusted.
  • B The self-signed certificate is more secure and equally trusted.
  • C The self-signed certificate is equally secure and equally trusted.
  • D The self-signed certificate is less secure and less trusted.
  • E The self-signed certificate is more secure and less trusted.
  • F The self-signed certificate is equally secure and less trusted.
Explanation

A self-signed corporate root can be an equally valid trust anchor when every relying MySQL client is controlled and configured to trust that CA. The same 2048-bit RSA cryptography can provide equivalent connection security, and the relevant clients trust the corporate CA just as they would trust a public CA. MySQL supports CA-based verification by having the client and server rely on the same CA certificate.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!