diff --git a/roles/mariadb/tasks/main.yml b/roles/mariadb/tasks/main.yml
index 2a2e768..2522a78 100644
--- a/roles/mariadb/tasks/main.yml
+++ b/roles/mariadb/tasks/main.yml
@@ -45,6 +45,13 @@
     owner: root
     group: mysql
 
+- name: allow mysql user to read private key
+  user:
+    name: mysql
+    groups: hostkey
+    append: yes
+  notify: restart mariadb
+
 - name: create tls configuration
   template:
     dest: /etc/my.cnf.d/tls.cnf