Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Amazon RDS instance running MySQL. I've created a user account, and I've configured MySQL to require the use of SSL for all logins to that account.

I want the MySQL client to be able to authenticate the server, to ensure that man-in-the-middle attacks cannot occur. The MySQL command-line client has an option for this, namely --ssl-verify-server-cert. However, when I try it, I get the following, uninformative, error message:

  ERROR 2026 (HY000): SSL connection error

So this command works fine:

  mysql --host $RDS_host --user $username \
  --password=$password \
  --ssl-ca mysql-ssl-ca-cert.pem -e '\s'

But if I add the option --ssl-verify-server-cert, I get the error message that I've just quoted. (By the way, the CA file was obtained from

Is there any way to get this option to work?

In one way, it's not surprising that the option fails to work, since the Amazon documentation (use the right-hand frame) states the following:

The SSL support in Amazon RDS is strictly for encrypting the connection between your client and your DB Instance; it should not be relied on for authenticating the server.

However, I don't see where the difficulty is, from Amazon's point of view. It seems to me that it would be quite easy for them to configure their server so that I could use --ssl-verify-server-cert.

share|improve this question
If you are connecting from EC2, it may be more efficient (i.e. simpler and less overhead) to setup a DB security group for your RDS instance and only allow access from instances in a given security group. (In that way, traffic is effectively firewalled, limiting access to the RDS instance and avoiding the SSL overhead). – cyberx86 Oct 10 '12 at 14:46
That would be ideal, but I don't want to force the client to have EC2 instances. – Banana Republic Oct 10 '12 at 14:53
I'd think that would mean the $RDS_host you specify is different from the Common Name that the RDS server certification uses. Maybe try to see the common name the server uses by using openssl s_client -connect $RDS_host:3306 2>/dev/null | grep CN. You could also add a couple of -v to your mysql command; maybe that would output more useful information when it fails. – Guillaume Boudreau Jan 9 '13 at 2:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.