I have two MySQL 5.7 databases ([db1] 5.7.27 and [db2] 5.7.29)

(n.b. db1 is Linux, db2 is Windows)

I have created a basic user on db1:

CREATE USER 'ssltest'@'%' IDENTIFIED BY 'ssltest';
GRANT ALL ON *.* TO 'ssltest'@'%' REQUIRE SSL;

I now connect from db2 to db1:

mysql -h1.2.3.4 -P3306 -ussltest -pssltest

And check the connection:

mysql> show session status like 'ssl_version';
| Variable_name | Value   | 
| Ssl_version   | TLSv1.1 |

mysql> show session status like 'ssl_cipher';
| Variable_name | Value              |
| Ssl_cipher    | DHE-RSA-AES256-SHA |

So, this suggests that my connection is indeed using SSL.

However, if I log onto db1 and run:

  sbt.variable_value AS tls_version,  
  t2.variable_value AS cipher, 
  processlist_user AS user, 
  processlist_host AS host 
FROM performance_schema.status_by_thread  AS sbt 
JOIN performance_schema.threads AS t ON t.thread_id = sbt.thread_id 
JOIN performance_schema.status_by_thread AS t2 ON t2.thread_id = t.thread_id 
WHERE sbt.variable_name = 'Ssl_version' 
and t2.variable_name = 'Ssl_cipher' 
ORDER BY tls_version;

I get no results, suggesting that it is not using SSL.

(n.b. If I look in the processlist I can see my connection, so it is definitely connected, and the performance-schema is enabled)

So which one is telling the truth. db1 which is receiving the connection or db2 which is initiating the connection?

  • use \s on the mysql client prompt to determine connection status, both ssl and user. ssl_cipher/version are global only variables so they won't help much.
    – danblack
    Jul 26 '20 at 2:36
  • It seems to be a difference between MySQL versions. Any 5.7 database I connect to shows I am using SSL in the status (\s) values, but nothing in the performance_schema.status_by_thread table, whereas any MySQL 8.0 database I connect to does show entries in the performance_schema.status_by_thread table.
    – IGGt
    Jul 27 '20 at 12:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.