This concerns my attempt to use a client side certificate on an SSL encrypted connection to a mysql server.
Some basics: Server is ubuntu 12.04 running mysql 14.14 Distrib 5.1.69. Client is MacOS 10.8.5 with mysql Ver 14.14 Distrib 5.5.25a
There are many ways to get this setup wrong, as witnessed by many posting here and elsewhere on the web. In this case, it appears the server side is configured correctly, as it is possible to use a command like
mysql --ssl-ca=CAcert.pem -u user -ppassword -h host.com -e '\s
to obtain a report that there is a cipher in use.
If however I add a client side certificate and key, like
mysql --ssl-ca=CAcert.pem --ssl-cert=clientCert.pem --ssl-key=keyFile -u user -ppassword -h host.com -e '\s'
this produces the very non-informative error message 'ERROR 2026 (HY000): SSL connection error: error:00000001:lib(0):func(0):reason(1)'. There is nothing in the server error log.
I have checked that the client certificate can be verified for the CA in use with openssl verify -purpose sslclient -CAfile CAcert.pem clientCert.pem
which returns ok.
The canonical names of the CAcert.pem and clientCert.pem are distinct. The CAcert.pem, clientCert.pem, and keyFile are all readable by the user (and even making the key world readable doesn't help).
Unfortunately, given the protocol used by mysql between client and server, it doesn't appear possible to use openssl client to do any debugging here.
Any suggestions on what the problem is? Or ways to obtain more debugging information on the client side?