0

[ I originally posted this on ServerFault but then was pointed at this community ]

Since moving from MySQL to a newer MariaDB installation on Debian 9, I a struggling with SSL connections.

I have created a CA certificate and installed it on both server and client. I then have created server and client keys and certificates that I signed with the CA certificate.

What works:

I can connect from the client to the server with the mysql client without SSL connections.

I can verify the client certificate with openssl:

$ openssl verify MariaDB_client.crt 

MariaDB_client.crt: OK

I understand that MariaDB uses yaSSL, but this still shows that the certificates and CA are correct, I think.

On the server, I have:

MariaDB> show global variables like '%ssl%';
+---------------------+--------------------------------------+
| Variable_name       | Value                                |
+---------------------+--------------------------------------+
| have_openssl        | NO                                   |
| have_ssl            | YES                                  |
| ssl_ca              | /etc/mysql/conf.d/MariaDB_ca.crt     |
| ssl_capath          |                                      |
| ssl_cert            | /etc/mysql/conf.d/MariaDB_server.crt |
| ssl_cipher          |                                      |
| ssl_crl             |                                      |
| ssl_crlpath         |                                      |
| ssl_key             | /etc/mysql/conf.d/MariaDB_server.key |
| version_ssl_library | YaSSL 2.4.4                          |
+---------------------+--------------------------------------+

What does not work:

If I add a .my.cnf file with the following content to the users $HOME directory...

[client]
ssl-ca=/--path--/MariaDB_ca.crt
ssl-cert=/--path--/MariaDB_client.crt
ssl-key=/--path--/MariaDB_client.key

...the connection fails with:

ERROR 2026 (HY000): SSL connection error: unable to verify peer checksum

In the server log, I find (not sure whether this is related):

[Warning] IP address 'ip.of.connecting.client' could not be resolved: Name or service not known

My questions:

  • How can I narrow down/debug this connection problem?

  • I found conflicting information about whether I should use the same or different CN for the server and client certificates. Currently, I use the same CN.

  • Are there particular access rights required for the certificates?

0

A good start is to use the openssl s_client command. You will need a fairly new version of openssl (1.1.0) - see https://serverfault.com/a/931652/317638 for more info.

Then you must remember -starttls mysql :

  openssl s_client -connect YOURHOSTNAME:3306  -CAfile /etc/mysql/cacert.pem  -starttls mysql

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.