Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to set up access to remote mysql server secured by SSL.

So far mysql client works flawlessly but I get exception when connecting via JDBC.

For now I'm testing it on my local machine.

I use self-signed certificates.

Here is the mysql connection line:

   mysql -u hajmon-ssl --ssl-cert lao-user3.crt --ssl-key lao-user3.pem  
         -h localhost --ssl-verify-server-cert -P 62201 
          --ssl-ca ssl-ca.crt hajmondb

(it works)

Here is the java test case:

     public static void main(String[] args) throws Exception{
        System.setProperty("javax.net.ssl.keyStore",
            "/home/jb/programs/fizyka/hajmon-matlab/keystore");
        System.setProperty("javax.net.ssl.keyStorePassword","foo");
        System.setProperty("javax.net.ssl.trustStore",
            "/home/jb/programs/fizyka/hajmon-matlab/truststore");
        System.setProperty("javax.net.ssl.trustStorePassword","foo");
        Properties properties = new Properties();
        properties.setProperty("requireSSL", "true");
        properties.setProperty("user", "hajmon-ssl");
        properties.setProperty("useSSL", "true");
        properties.setProperty("password", "");
        Connection connection = DriverManager.getConnection(
            "jdbc:mysql://localhost:62201/hajmondb", properties);

        Statement statement = connection.createStatement();
        statement.execute("SELECT 2+2;");
        System.out.println(statement.getResultSet());
     }

I got around simple gothas, I'm sure that Keystores are found, and private keys are read. Also certificates in keystores are the same as ones used by mysql client. Truststore contains CA certificate and Server certificate (signed by CA), keystore contains single key --- certificate pair encrypted with password 'foo'. All keys use RSA 4096 and sha256.

Exception I get is, well cryptic:

    Caused by: java.net.SocketException: Broken pipe
at java.net.SocketOutputStream.socketWrite0(Native Method)
at java.net.SocketOutputStream.socketWrite(SocketOutputStream.java:92)
at java.net.SocketOutputStream.write(SocketOutputStream.java:136)
at com.sun.net.ssl.internal.ssl.OutputRecord.writeBuffer(OutputRecord.java:297)
at com.sun.net.ssl.internal.ssl.OutputRecord.write(OutputRecord.java:286)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecordInternal(SSLSocketImpl.java:743)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:731)
at com.sun.net.ssl.internal.ssl.Handshaker.sendChangeCipherSpec(Handshaker.java:683)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.sendChangeCipherAndFinish(ClientHandshaker.java:985)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverHelloDone(ClientHandshaker.java:904)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:238)
at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)
at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:893)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1138)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1165)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1149)
at com.mysql.jdbc.ExportControlled.transformSocketToSSLSocket(ExportControlled.java:92)
... 21 more

Anyone has slightest idea what can be the reason of this error?

share|improve this question
    
I've seen some errors like this before in java when people used localhost. Have you tried replacing it with 127.0.0.1? Can you connect to the mysql via telnet? telnet localhost 62201 –  Bart De Vos Apr 21 '11 at 21:57
    
Telnet works. Replacing localhost with 127.0.0.1 didn't. And as I said --- native mysql client works –  jb. Apr 21 '11 at 21:59
    
Had a hell of a time getting MySQL working with SSL from a Windows 2k8/ASP.NET application; kept getting Network password is incorrect. Turns out I hadn't used a passphrase on the private key (which was converted to .pfx); as soon as I added a passphrase, added CertificatePassword=mypassphrase to the connection string, it worked. –  gravyface Apr 22 '11 at 0:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.