Add TLS for mysql

Use ssl_mode for mysql and add docs
add docs for the new parameters in config

Tolerate ssl_mode without client authentication

Client cert is not necessary for a SSL connection. So we tolerate
failure if client cert is not provided.
Improve error message if missing server_cert_name and mode is not
skip-verify.

pkg/services/sqlstore/sqlstore.go

@@ -18,8 +18,17 @@ import (
 	"github.com/go-xorm/xorm"
 	_ "github.com/lib/pq"
 	_ "github.com/mattn/go-sqlite3"
+	"github.com/go-sql-driver/mysql"
 )
 
+type MySQLConfig struct {
+	SslMode string
+	CaCertPath string
+	ClientKeyPath  string
+	ClientCertPath string
+	ServerCertName string
+}
+
 var (
 	x       *xorm.Engine
 	dialect migrator.Dialect
@@ -30,6 +39,8 @@ var (
 		Type, Host, Name, User, Pwd, Path, SslMode string
 	}
 
+	mysqlConfig MySQLConfig
+
 	UseSQLite3 bool
 )
 
@@ -115,6 +126,14 @@ func getEngine() (*xorm.Engine, error) {
 	case "mysql":
 		cnnstr = fmt.Sprintf("%s:%s@tcp(%s)/%s?charset=utf8",
 			DbCfg.User, DbCfg.Pwd, DbCfg.Host, DbCfg.Name)
+		if mysqlConfig.SslMode == "true" || mysqlConfig.SslMode == "skip-verify" {
+			tlsCert, err := makeCert("custom", mysqlConfig)
+			if err != nil {
+				return nil, err
+			}
+			mysql.RegisterTLSConfig("custom", tlsCert)
+			cnnstr += "&tls=custom"
+		}
 	case "postgres":
 		var host, port = "127.0.0.1", "5432"
 		fields := strings.Split(DbCfg.Host, ":")
@@ -156,4 +175,12 @@ func LoadConfig() {
 	}
 	DbCfg.SslMode = sec.Key("ssl_mode").String()
 	DbCfg.Path = sec.Key("path").MustString("data/grafana.db")
+
+	if DbCfg.Type == "mysql" {
+		mysqlConfig.SslMode = DbCfg.SslMode
+		mysqlConfig.CaCertPath = sec.Key("ca_cert_path").String()
+		mysqlConfig.ClientKeyPath = sec.Key("client_key_path").String()
+		mysqlConfig.ClientCertPath = sec.Key("client_cert_path").String()
+		mysqlConfig.ServerCertName = sec.Key("server_cert_name").String()
+	}
 }