MySQL [Bad handshake] error after update

Question

I have MASTER-SLAVE configuration on 2 servers. The MySQL replication is set over SSL (I use self-signed certificates).

Everything had been working well. But today some packages (mysql also) were updated via apt update, upgrade. Current version is: mysql Ver 14.14 Distrib 5.7.28, for Linux (x86_64)

Both server and client have the same mysql version now, but slave can't connect to the master. In master's log I see the following error repeating many times:

2019-11-19T16:49:55.109509Z 1130 [Note] Bad handshake
2019-11-19T16:50:55.296184Z 1432 [Note] Bad handshake

What should I check in order to fix this problem? I've already tried to reissue certificates, but it didn't help.

Thanks.

Answer 1

MySQL 5.7.28 dropped support for yaSSL. On some platforms, such as RHEL and presumably Ubuntu, that resulted in a change from yaSSL to OpenSSL. There are a variety of things that would have worked under yaSSL but no longer work under OpenSSL. For example, yaSSL could not handle certificate chains, but OpenSSL both sends and verifies full chains.

Among other troubleshooting techniques, try taking a packet capture of the TLS handshake with tcpdump and decoding it in Wireshark.

Answer 2

Okay, the reason was that new version of mysql refuses to accept certs with the same Common Name etc.

I reissued certs for server and client using different metadata this time, updated my.cnf on both master and slave servers and now it works again.

Do not forget to login into MySQL

mysql -u root -p

and update master host details if necessary (MASTER_SSL_CA, MASTER_SSL_CERT MASTER_SSL_KEY)!

CHANGE MASTER TO MASTER_HOST='HOSTIP', MASTER_USER='SLAVEUSER', MASTER_PASSWORD='PWD', MASTER_LOG_FILE='mysql-bin.000001', MASTER_LOG_POS=112233, MASTER_SSL=1, MASTER_SSL_CA = '/etc/mysql/new-ca-cert.pem', MASTER_SSL_CERT = '/etc/mysql/new-client-cert.pem', MASTER_SSL_KEY = '/etc/mysql/new-client-key.pem';