MySQL Server: Enterprise Edition 8.0.16-Commercial OS: RHEL 7.5 (Maipo) 3.10.0-862.11.6.el7.x86_64
I am trying to understand SSL/TLS enabled connections for MySQL servers. I am trying to configure it currently on test servers before I could implement it on the production servers.
From MySQL Docs -- On the server side, the --ssl option specifies that the server permits but does not require encrypted connections. This option is enabled by default, so it need not be specified explicitly. To require that clients connect using encrypted connections, enable the require_secure_transport system variable.
I have not created the SSL certificates, these are default self-signed certificates.
My Server side configuration is as follows
[client] ssl-cert = /mysql_data/mysql/client-cert.pem ssl-key = /mysql_data/mysql/client-key.pem [mysqld] ssl ssl-cipher = DHE-RSA-AES256-SHA ssl-ca = /mysql_data/mysql/ca.pem ssl-cert = /mysql_data/mysql/server-cert.pem ssl-key = /mysql_data/mysql/server-key.pem require_secure_transport = ON
I created a user to connect to the server as follows
CREATE USER 'tester'@'10.128.0.196' IDENTIFIED WITH 'Secure12#$' REQUIRE X509;
The MySQL server is at 10.128.0.197 and the client is at 10.128.0.196. I copied the ca.pem, client-cert.pem, client-key.pem to the client machine under /mysql_data/ssl-certs directory.
When I try to connect to the server using following command, I am able to connect to the server using --ssl-mode=VERIFY_CA or --ssl-mode=REQUIRED.
$ mysql -utester -pSecure12#$ -P 3310 -h 10.128.0.197 --ssl-mode=verify_ca --ssl-ca=/mysql_data/ssl-certs/ca.pem --ssl-cert=/mysql_data/ssl-certs/client-cert.pem --ssl-key=/mysql_data/ssl-certs/client-key.pem
However, when I use --ssl-mode=VERIFY_IDENTITY, I receive the following error.
ERROR 2026 (HY000): SSL connection error: Failed to verify the server certificate via X509 certificate matching functions
If I understand correctly, the VERIFY_IDENTITY option verifies the server's host-name as well.
Could you help me understand if I am doing it correctly or if I am missing anything. Why the VERIFY_IDENTITY option fails?
One explanation ( I think I read somewhere on the MySQL Docs but I am not sure) is that because the certificates are self-signed, they don't contain the hostname information.
Any help will be great. Next, I will try OpenSSL to create the required certificates and check. I will post my findings.