Hello @raaijmakersmaarten,

Since the SSL certificates directory is owned by group ssl-private and since mysqld-safe runs as mysqlgroup, Linux won't allow reading the private key. With dkim I successfully forced the program to run as a different group by editing the init script.

Solution:

Make a copy of the certificates/keys directory and chown to mysql:mysql. Requires to synchronize the copies of the keys at every renewal. Perfectly scalable across applications and number of servers (suppose the same certificate is used by other apps too, for example Postfix) as soon as one updates the certificates with a script or a checklist (so you won't forget to copy certificates to a certain app)

If you found this useful please upvote or mark this as the right answer!

Happy coding!