Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an Amazon RDS instance running MySQL. I've created a user account, and I've configured MySQL to require the use of SSL for all logins to that account.

I want the MySQL client to be able to authenticate the server, to ensure that man-in-the-middle attacks cannot occur. The MySQL command-line client has an option for this, namely --ssl-verify-server-cert. However, when I try it, I get the following, uninformative, error message:

  ERROR 2026 (HY000): SSL connection error

So this command works fine:

  mysql --host $RDS_host --user $username \
  --password=$password \
  --ssl-ca mysql-ssl-ca-cert.pem -e '\s'

But if I add the option --ssl-verify-server-cert, I get the error message that I've just quoted. (By the way, the CA file was obtained from https://rds.amazonaws.com/doc/mysql-ssl-ca-cert.pem.)

Is there any way to get this option to work?

In one way, it's not surprising that the option fails to work, since the Amazon documentation (use the right-hand frame) states the following:

The SSL support in Amazon RDS is strictly for encrypting the connection between your client and your DB Instance; it should not be relied on for authenticating the server.

However, I don't see where the difficulty is, from Amazon's point of view. It seems to me that it would be quite easy for them to configure their server so that I could use --ssl-verify-server-cert.

share|improve this question
    
If you are connecting from EC2, it may be more efficient (i.e. simpler and less overhead) to setup a DB security group for your RDS instance and only allow access from instances in a given security group. (In that way, traffic is effectively firewalled, limiting access to the RDS instance and avoiding the SSL overhead). –  cyberx86 Oct 10 '12 at 14:46
    
That would be ideal, but I don't want to force the client to have EC2 instances. –  Banana Republic Oct 10 '12 at 14:53
    
I'd think that would mean the $RDS_host you specify is different from the Common Name that the RDS server certification uses. Maybe try to see the common name the server uses by using openssl s_client -connect $RDS_host:3306 2>/dev/null | grep CN. You could also add a couple of -v to your mysql command; maybe that would output more useful information when it fails. –  Guillaume Boudreau Jan 9 '13 at 2:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.