# How to add ssl certificate for MySQL connection for metricbeat **URL:** \ **Category:** Beats\ **Tags:** metricbeat\ **Created:** [February 4, 2020, 4:53pm UTC](https://discuss.elastic.co/t/how-to-add-ssl-certificate-for-mysql-connection-for-metricbeat/217851 "2020-02-04T16:53:33Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Aurel\_Drejta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aurel_drejta/32/59925_2.png) [@Aurel\_Drejta](https://discuss.elastic.co/u/Aurel_Drejta)\ **Post date:** [February 4, 2020, 4:53pm UTC](https://discuss.elastic.co/t/how-to-add-ssl-certificate-for-mysql-connection-for-metricbeat/217851/1 "2020-02-04T16:53:33Z")
Where can i add the SSL certificate to connect to MySQL server when i configure the MySQL module file (mysql.yaml)? Sorry if this is something obvious but i can't find it anywhere. [https://www.elastic.co/guide/en/beats/metricbeat/current/configuration-ssl.html](https://www.elastic.co/guide/en/beats/metricbeat/current/configuration-ssl.html) Here it says that there is an example to use a module with SSL but the ssl.verification mode is set to none and there is no place to specify where the SSL certificate is located. [https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-mysql.html](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-mysql.html) Even in the MySQL module there is no mention of applying an SSL certificate to the configuration file ---
**Author:** ![ropc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ropc/32/47022_2.png) [@ropc](https://discuss.elastic.co/u/ropc)\ **Post date:** [February 5, 2020, 8:06am UTC](https://discuss.elastic.co/t/how-to-add-ssl-certificate-for-mysql-connection-for-metricbeat/217851/2 "2020-02-05T08:06:40Z")
Hi @Aurel_Drejta - Can you add the `tls` [parameter](https://github.com/Go-SQL-Driver/MySQL/#tls) in your host DSN and check if that works? ---
**Author:** ![Aurel\_Drejta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aurel_drejta/32/59925_2.png) [@Aurel\_Drejta](https://discuss.elastic.co/u/Aurel_Drejta)\ **Post date:** [February 5, 2020, 4:00pm UTC](https://discuss.elastic.co/t/how-to-add-ssl-certificate-for-mysql-connection-for-metricbeat/217851/3 "2020-02-05T16:00:35Z")
Hi @ropc It seems that got me closer to a solution but i have a tiny hiccup now. I'm trying to connect to a MySQL instance hosted in AWS RDS and when i try to connect to it the metricbeat logs display "x509: certificate signed by unknown authority" Any idea how i can add the AWS RDS certificate in order to use a tls connection? The RDS certificates are public and i have them downloaded from their website. Or do i have to do something else? I'll try to do this in an EC2 instance to see if maybe the instance will trust the authority. ---
**Author:** ![ropc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ropc/32/47022_2.png) [@ropc](https://discuss.elastic.co/u/ropc)\ **Post date:** [February 6, 2020, 4:59am UTC](https://discuss.elastic.co/t/how-to-add-ssl-certificate-for-mysql-connection-for-metricbeat/217851/4 "2020-02-06T04:59:21Z")
@Aurel_Drejta - I do not think there is any option right now in the MySQL module or Metricbeat to specify a list of trusted certificates to connect to the database. If you use the `tls=true` option, what you could do is to: - download the [root certificate for all AWS Regions](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html) - in the host where you are running Metricbeat, add this root CA (and trust it) in the certificate store. That should do the trick (I tested it in my lab). ---
**Author:** ![Aurel\_Drejta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aurel_drejta/32/59925_2.png) [@Aurel\_Drejta](https://discuss.elastic.co/u/Aurel_Drejta)\ **Post date:** [February 6, 2020, 9:47am UTC](https://discuss.elastic.co/t/how-to-add-ssl-certificate-for-mysql-connection-for-metricbeat/217851/5 "2020-02-06T09:47:02Z")
@ropc - Yep that did the trick. Thank for the help, i very much appreciate it. I think the MySQL module for Metricbeat should add an option to specify the certificate you can use to connect. ( Just an idea for future improvements ) ---
**Author:** ![ropc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ropc/32/47022_2.png) [@ropc](https://discuss.elastic.co/u/ropc)\ **Post date:** [February 6, 2020, 1:09pm UTC](https://discuss.elastic.co/t/how-to-add-ssl-certificate-for-mysql-connection-for-metricbeat/217851/6 "2020-02-06T13:09:44Z")
@Aurel_Drejta I opened a [Github issue](https://github.com/elastic/beats/issues/16133) in the `beats` repository. You can subscribe to it for further updates. Thanks again for your collaboration and I am glad we solved your problem 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 5, 2020, 1:09pm UTC](https://discuss.elastic.co/t/how-to-add-ssl-certificate-for-mysql-connection-for-metricbeat/217851/7 "2020-03-05T13:09:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.