0

MySQL Server: Enterprise Edition 8.0.16-Commercial OS: RHEL 7.5 (Maipo) 3.10.0-862.11.6.el7.x86_64

I am trying to understand SSL/TLS enabled connections for MySQL servers. I am trying to configure it currently on test servers before I could implement it on the production servers.

From MySQL Docs -- On the server side, the --ssl option specifies that the server permits but does not require encrypted connections. This option is enabled by default, so it need not be specified explicitly. To require that clients connect using encrypted connections, enable the require_secure_transport system variable.

I have not created the SSL certificates, these are default self-signed certificates.

My Server side configuration is as follows

[client]
ssl-cert    =        /mysql_data/mysql/client-cert.pem
ssl-key     =        /mysql_data/mysql/client-key.pem

[mysqld]

ssl
ssl-cipher  =        DHE-RSA-AES256-SHA
ssl-ca      =        /mysql_data/mysql/ca.pem
ssl-cert    =        /mysql_data/mysql/server-cert.pem
ssl-key     =        /mysql_data/mysql/server-key.pem
require_secure_transport   =  ON

I created a user to connect to the server as follows

CREATE USER 'tester'@'10.128.0.196' IDENTIFIED WITH 'Secure12#$' REQUIRE X509;

The MySQL server is at 10.128.0.197 and the client is at 10.128.0.196. I copied the ca.pem, client-cert.pem, client-key.pem to the client machine under /mysql_data/ssl-certs directory.

When I try to connect to the server using following command, I am able to connect to the server using --ssl-mode=VERIFY_CA or --ssl-mode=REQUIRED.

$ mysql -utester -pSecure12#$ -P 3310 -h 10.128.0.197 --ssl-mode=verify_ca --ssl-ca=/mysql_data/ssl-certs/ca.pem --ssl-cert=/mysql_data/ssl-certs/client-cert.pem --ssl-key=/mysql_data/ssl-certs/client-key.pem 

enter image description here

However, when I use --ssl-mode=VERIFY_IDENTITY, I receive the following error.

ERROR 2026 (HY000): SSL connection error: Failed to verify the server certificate via X509 certificate matching functions

If I understand correctly, the VERIFY_IDENTITY option verifies the server's host-name as well.

Could you help me understand if I am doing it correctly or if I am missing anything. Why the VERIFY_IDENTITY option fails?

One explanation ( I think I read somewhere on the MySQL Docs but I am not sure) is that because the certificates are self-signed, they don't contain the hostname information.

Any help will be great. Next, I will try OpenSSL to create the required certificates and check. I will post my findings.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.