TLS and Cryptography Libraries Used by MariaDB

When MariaDB Server is compiled with TLS and cryptography support, it is usually either statically linked with MariaDB's bundled TLS and cryptography library or dynamically linked with the system's OpenSSL library. MariaDB's bundled TLS library is either wolfSSL or yaSSL, depending on the server version.

When a MariaDB client or client library is compiled with TLS and cryptography support, it is usually either statically linked with MariaDB's bundled TLS and cryptography library or dynamically linked with the system's TLS and cryptography library, which might be OpenSSL, GnuTLS, or Schannel.

Checking Dynamically vs. Statically Linked

Dynamically linking MariaDB to the system's TLS and cryptography library can often be beneficial, since this allows you to fix bugs in the system's TLS and cryptography library independently of MariaDB. For example, when information on the in was released in 2014, the bug could be mitigated by simply updating your system to use a fixed version of the library, and then restarting the MariaDB Server.

You can verify that mysqld is in fact dynamically linked to the shared library on your system by using the command:

If the command does not return any results, then either your mysqld is statically linked to the TLS and cryptography library on your system or your mysqld is not built with TLS and cryptography support at all.

Checking If the Server Uses OpenSSL

If you aren't sure whether your server is linked with or the bundled TLS library, then you can check the value of the system variable. For example:

Checking the Server's OpenSSL Version

If you want to see what version of your server is using, then you can check the value of the system variable. For example:

Note that the version returned by this system variable does not always necessarily correspond to the exact version of the package installed on the system. shared libraries tend to contain interfaces for multiple versions at once to allow for backward compatibility. Therefore, if the package installed on the system is newer than the version that the MariaDB Server binary was built with, then the MariaDB Server binary might use one of the interfaces for an older version. See for more information. For example:

FIPS Certification

are standards published by the U.S. federal government that are used to establish requirements for various aspects of computer systems. is a set of standards for security requirements for cryptographic modules.

This standard is relevant when discussing the TLS and cryptography libraries used by MariaDB. Some of these libraries have been certified to meet the standards set by FIPS 140-2.

FIPS Certification by OpenSSL

The library has a special FIPS mode that has been certified to meet the FIPS 140-2 standard. In FIPS mode, only algorithms and key sizes that meet the FIPS 140-2 standard are enabled by the library.

MariaDB does not yet support enabling FIPS mode within the database server. See for more information. Therefore, if you would like to use OpenSSL's FIPS mode with MariaDB, then you would either need to enable FIPS mode at the kernel level or enable it via the OpenSSL configuration file, system-wide or only for the MariaDB process.. See the following resources for more information on how to do that:

FIPS Certification by wolfSSL

The standard version of the library has not been certified to meet the FIPS 140-2 standard, but a special version has been certified. Unfortunately, the "FIPS-ready" version of wolfSSL uses a license that is incompatible with MariaDB's license, so it cannot be used with MariaDB.

FIPS Certification by yaSSL

The library has not been certified to meet the FIPS 140-2 standard.

Libraries Used by Each Platform and Package

MariaDB Server

MariaDB Server on Windows

MariaDB Server is statically linked with the bundled library in and packages on Windows.

MariaDB Server on Linux

MariaDB Server in Binary Tarballs

MariaDB Server is statically linked with the bundled library in on Linux.

MariaDB Server in DEB Packages

MariaDB Server is dynamically linked with the system's library in packages.

See for more information.

MariaDB Server in RPM Packages

MariaDB Server is dynamically linked with the system's library in packages.

MariaDB Clients and Utilities

has been included with MariaDB Server, and the bundled and the clients and utilities are linked with it. On some platforms, and these may use a different TLS library than the one used by MariaDB Server and .

MariaDB Clients and Utilities on Windows

MariaDB's and are dynamically linked with the system's libraries in and packages on Windows. is still statically linked with the bundled library. <>

MariaDB Clients and Utilities on Linux

MariaDB Clients and Utilities in Binary Tarballs

MariaDB's and are statically linked with the library in on Linux. is still statically linked with the bundled library. <>

MariaDB Clients and Utilities in DEB Packages

MariaDB's , , and are dynamically linked with the system's library in packages.

See for more information.

MariaDB Clients and Utilities in RPM Packages

MariaDB's , , and are dynamically linked with the system's library in packages.

Updating Dynamically Linked OpenSSL Libraries on Linux

When the MariaDB Server or clients and utilities are dynamically linked to the system's library, it makes it very easy to update the libraries. The information below will show how to update these libraries for each platform.

Updating Dynamically Linked OpenSSL Libraries with yum/dnf

On RHEL, CentOS, Fedora, and other similar Linux distributions, it is highly recommended to update the libraries using or . Starting with RHEL 8 and Fedora 22, yum has been replaced by dnf, which is the next major version of yum. However, yum commands still work on many systems that use dnf. For example:

Update the package by executing the following command:

And then restart MariaDB server and any clients or applications that use the library.

Updating Dynamically Linked OpenSSL Libraries with apt-get

On Debian, Ubuntu, and other similar Linux distributions, it is highly recommended to recommended to update the libraries using . For example:

First update the package cache by executing the following command:

And then update the package by executing the following command:

And then MariaDB server and any clients or applications that use the library.

Updating Dynamically Linked OpenSSL Libraries with zypper

On SLES, OpenSUSE, and other similar Linux distributions, it is highly recommended to recommended to update the libraries using . For example:

Update the package by executing the following command:

And then MariaDB server and any clients or applications that use the library.

_{This page is licensed: CC BY-SA / Gnu FDL}