Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This concerns my attempt to use a client side certificate on an SSL encrypted connection to a mysql server.

Some basics: Server is ubuntu 12.04 running mysql 14.14 Distrib 5.1.69. Client is MacOS 10.8.5 with mysql Ver 14.14 Distrib 5.5.25a

There are many ways to get this setup wrong, as witnessed by many posting here and elsewhere on the web. In this case, it appears the server side is configured correctly, as it is possible to use a command like

mysql --ssl-ca=CAcert.pem -u user -ppassword -h host.com -e '\s

to obtain a report that there is a cipher in use.

If however I add a client side certificate and key, like

mysql --ssl-ca=CAcert.pem --ssl-cert=clientCert.pem --ssl-key=keyFile -u user -ppassword -h host.com -e '\s'

this produces the very non-informative error message 'ERROR 2026 (HY000): SSL connection error: error:00000001:lib(0):func(0):reason(1)'. There is nothing in the server error log.

I have checked that the client certificate can be verified for the CA in use with openssl verify -purpose sslclient -CAfile CAcert.pem clientCert.pem

which returns ok.

The canonical names of the CAcert.pem and clientCert.pem are distinct. The CAcert.pem, clientCert.pem, and keyFile are all readable by the user (and even making the key world readable doesn't help).

Unfortunately, given the protocol used by mysql between client and server, it doesn't appear possible to use openssl client to do any debugging here.

Any suggestions on what the problem is? Or ways to obtain more debugging information on the client side?

share|improve this question
    
Are both the client and server using the same CAfile certificate? You should try connecting with openssl's s_client function and see where it breaks out. That error sounds like it drops before it actually gets to the mysql protocol portion. –  Andrew Domaszek Sep 21 '13 at 3:56
    
Yes, they have the same CAcert.pem. As noted above, openssl s_client doesn't work for debugging because of the protocol used by mysql. So far I haven't been able to get the client side certificates working with the command line mysql client, though providing only the -ssl-ca certificate results in an encrypted connection but no checks on the client certificate. –  user1204270 Oct 10 '13 at 22:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.