Since the SSL certificates directory is owned by group
ssl-private and since
mysqld-safe runs as
mysqlgroup, Linux won’t allow reading the private key. With dkim I successfully forced the program to run as a different group by editing the init script.
Make a copy of the certificates/keys directory and
mysql:mysql. Requires to synchronize the copies of the keys at every renewal. Perfectly scalable across applications and number of servers (suppose the same certificate is used by other apps too, for example Postfix) as soon as one updates the certificates with a script or a checklist (so you won’t forget to copy certificates to a certain app)
If you found this useful please upvote or mark this as the right answer!