Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


Using WireShark I found out the problem string (I hope I did):

28 | 9.582638 | | | MySQL Response Error 1043

And the error is (according to docs):

Message: Bad handshake 

Here are the screenshots of WireShark in two cases:

Connection from Windows 8 (Success):

enter image description here

Connection from CentOS (Fail):

enter image description here

Why does this happen?


One interesting notice:
I have successfully connected with Master DB using Windows 8 ( by modifying ssluser setting on Master for host - made a change: from REQUIRE SSL to REQUIRE X509. However this doesn't work in our case with slave-to-master connection.

I have faced with SSL replication problem in CentOS-6.3. I am using OpenSSL to create both clients and server certificates and both clients and server certificates are signed by the same CA.

Server IP:
Slave  IP:
MySQL version 5.1.66 SSL

All certificates I receive using "Setting Up SSL Certificates and Keys for MySQL" section of MySQL help pages.

Server's my.cnf file:


Client's my.cnf file:


On Master I setup slave user with SSL like this:

CREATE USER 'ssluser'@'' IDENTIFIED BY 'sslpass';

To update Slave I am using the following command (according to show master status command):

             MASTER_HOST='',                      \
             MASTER_USER='sslreplicant',                        \
             MASTER_PASSWORD='db.sslreplicantprimary',          \
             MASTER_LOG_FILE='mysql-bin.000026',                \
             MASTER_LOG_POS=106,                                \
             MASTER_SSL=1,                                      \
             MASTER_SSL_CA='/etc/mysql/certs/ca-cert.pem',      \
             MASTER_SSL_CAPATH='/etc/mysql/certs/',             \

Replication itself works fine:

mysql> SHOW VARIABLES LIKE '%ssl%';

have_openssl  = YES
have_ssl      = YES
ssl_ca        = /etc/mysql/certs/ca-cert.pem
ssl_capath    =
ssl_cert      = /etc/mysql/certs/server-cert.pem
ssl_cipher    =
ssl_key       = /etc/mysql/certs/server-key.pem

This is both - on Master and on Slave.

But when I manually check the connection from Slave to Master I receive an error.

Here are the options I tried so far (the same result from everyone):

[gahcep@localhost  ~]$ mysql -u ssluser -h -p

[gahcep@localhost  ~]$ mysql --ssl --ssl-ca=/etc/mysql/certs/ca-cert.pem \
                             -u ssluser -h -p

[gahcep@localhost ~]$ mysql --ssl-ca=/etc/mysql/certs/ca-cert.pem \
                            --ssl-cert=/etc/mysql/certs/client-cert.pem \
                            --ssl-key=/etc/mysql/certs/client-key.pem \
                            -u ssluser -h -p

Enter password:
ERROR 2026 (HY000): SSL connection error

Steps to Reproduce:

  1. setup/create both clients and server certs signed by same ca.
  2. setup both my.cnf files on clients and servers as mentioned in this thread
  3. create ssluser on master for slave
  4. mysql -u ssluser -h -p

Please, note, I indeed used different Common Names for all certificates: for CA, clien and server.


Verification results:

[gahcep@localhost ~]$ sudo openssl verify -purpose sslclient \
           -CAfile /etc/mysql/certs/ca-cert.pem /etc/mysql/certs/client-cert.pem
/etc/mysql/certs/client-cert.pem: OK

[gahcep@localhost ~]$ sudo openssl verify -purpose sslserver \
           -CAfile /etc/mysql/certs/ca-cert.pem /etc/mysql/certs/server-cert.pem
/etc/mysql/certs/server-cert.pem: OK

Sertificates information:


[gahcep@localhost ~]$ sudo openssl x509 -noout -subject -issuer -dates \
           -serial -hash -fingerprint -in /etc/mysql/certs/ca-cert.pem
subject= /C=RU/L=Vladivostok/O=Default Company Ltd/CN=PriSec
issuer= /C=RU/L=Vladivostok/O=Default Company Ltd/CN=PriSec
notBefore=Jan  4 06:27:46 2013 GMT
notAfter=Nov 13 06:27:46 2022 GMT
SHA1 Fingerprint=5B:07:AA:39:28:24:CE:1A:CF:35:FA:14:36:23:65:8F:84:61:B0:1C

Client Certificate:

[gahcep@localhost ~]$ sudo openssl x509 -noout -subject -issuer -dates \
           -serial -hash -fingerprint -in /etc/mysql/certs/client-cert.pem
subject= /C=RU/L=Vladivostok/O=Default Company Ltd/CN=Secondary
issuer= /C=RU/L=Vladivostok/O=Default Company Ltd/CN=PriSec
notBefore=Jan  4 06:29:07 2013 GMT
notAfter=Nov 13 06:29:07 2022 GMT
SHA1 Fingerprint=F5:9F:4A:14:E8:96:26:BC:71:79:43:5E:18:BA:B2:24:BE:76:17:52

Server Certificate:

[gahcep@localhost ~]$ sudo openssl x509 -noout -subject -issuer -dates \
            -serial -hash -fingerprint -in /etc/mysql/certs/server-cert.pem
subject= /C=RU/L=Vladivostok/O=Default Company Ltd/CN=Primary
issuer= /C=RU/L=Vladivostok/O=Default Company Ltd/CN=PriSec
notBefore=Jan  4 06:28:25 2013 GMT
notAfter=Nov 13 06:28:25 2022 GMT
SHA1 Fingerprint=39:9E:7A:9E:60:9A:58:68:81:2F:90:A5:9B:BF:E8:26:C5:9D:3C:AB

Directories Permissions:

On Master:

[gahcep@localhost ~]$ ls -la /etc/mysql/certs/
drwx------. 3 mysql  mysql  4096 Jan  3 23:49 .
drwx------. 3 mysql  mysql  4096 Jan  3 07:34 ..
-rw-rw-r--. 1 gahcep gahcep 1261 Jan  3 22:27 ca-cert.pem
-rw-rw-r--. 1 gahcep gahcep 1675 Jan  3 22:27 ca-key.pem
-rw-rw-r--. 1 gahcep gahcep 1135 Jan  3 22:28 server-cert.pem
-rw-rw-r--. 1 gahcep gahcep 1679 Jan  3 22:28 server-key.pem
-rw-rw-r--. 1 gahcep gahcep  976 Jan  3 22:28 server-req.pem

On Slave:

[gahcep@localhost ~]$ ls -la /etc/mysql/certs/
drwx------. 3 mysql mysql 4096 Jan  3 22:57 .
drwx------. 3 mysql mysql 4096 Jan  3 07:50 ..
-rw-r--r--. 1 root  root  1261 Jan  3 22:56 ca-cert.pem
-rw-r--r--. 1 root  root  1139 Jan  3 22:57 client-cert.pem
-rw-r--r--. 1 root  root  1675 Jan  3 22:57 client-key.pem

If someone can suggest the solution, I would really appreciate this!

share|improve this question

migrated from Jan 8 '13 at 3:34

This question came from our site for system and network administrators.

A note to users: The op has asked for a migration as it's not getting any love here. If you don't feel it appropriate, my apologies. – Mark Henderson Jan 8 '13 at 3:34
Anyway, thanks, Mark. – gahcep Jan 8 '13 at 6:22
Hi gahcep, your MySQL distribution is configured to use the bundled yaSSL library or the OpenSSL? – Cristian Porta Jan 9 '13 at 16:55
Hi, Cristian. Actually, I just took a binary distribution from the main site. If there is a command to verify this, please, tell me and I will check what kind of SSL mysql is confugered with. – gahcep Jan 9 '13 at 22:30
Hi gahcep, binary distribution on MySQL is bundled with yaSSL, so I think you use this kind of SSL (check point 2 of Configuring MySQL for SSL). – Cristian Porta Jan 10 '13 at 7:09

Possible solutions:

How to tell whether MySQL Server uses yaSSL or OpenSSL

That shows a workaround for the lack of a suitable global status value. The idea is to check for the Rsa_public_key status variable:

mysql> show status like '%rsa%';
| Variable_name  | Value |
| Rsa_public_key |       |
1 row in set (0.00 sec)

If OpenSSL is in use, that variable will exist; otherwise it is yaSSL.

Other possibility:

MySQL and SSL connection failing ERROR 2026 (HY000) (Stack Overflow)

share|improve this answer
Try to avoid posting link-only answers as they are not very useful. Check out out the site tour for more info on how to post good answers. – John M Feb 20 '15 at 16:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.