I' am trying to connect to my AWS RDS MySQL instance with terminal on OSX El Captain, but I keep getting this error:
ERROR 2026 (HY000): SSL connection error: error:00000001:lib(0):func(0):reason(1)
This is a fresh OSX install, and I used brew to install mysql along with openssl, I can connect to the local server. Also it seems MySQL workbench works perfectly fine.
My Ubuntu machine connects to the RDS instance fine as well through terminal.
I had the same problem and figured it out-ish! brew most likely installed mysql 5.7 which, from what I can gather, requires ssl unless other wise specified by --skip-ssl. You can uninstall mysql by running brew uninstall mysql and then install 5.5 by running brew install https://raw.githubusercontent.com/Homebrew/homebrew-versions/master/mysql55.rb && brew link homebrew/versions/mysql55 --force.
Granted, this doesn't solve the problem of getting the initial error fixed, but I haven't found any documentation as to why 5.7 differs from 5.5 in such a way fresh out of the box. Best of luck to you!
Edit: Aha! Here's the documentation:
--sslFor the MySQL server, this option specifies that the server permits but does not require SSL connections. The option is enabled on the server side by default as of MySQL 5.7.5, and disabled before 5.7.5. Also as of MySQL 5.7.5, MySQL servers compiled using OpenSSL can generate missing SSL files automatically at startup. See Section 6.3.13.1, “Creating SSL and RSA Certificates and Keys using MySQL”.
Edit 2:
Another option, instead of downgrading to 5.5, you can open up (or create) /etc/my.cnf or /etc/mysql/my.cnf and add the following with your existing mysql > 5.7.5:
[client]
ssl=0
This will disabled ssl on client connections and behave like mysql < 5.7.5.
my.cnf file in /usr/local/etc. (This didn't work for me as /usr/local/etc/mysql/my.cnf, however.)
Dec 9, 2015 at 21:22
--skip-ssl (or --ssl-mode=DISABLED for MySQL 8.0) doesn't solve that problem, it only bypasses it.
The error occures when the SSL handshake encountered an error, MySQL lacks of details about that, and this is an opened bug : https://bugs.mysql.com/bug.php?id=75311
You should first check your certificates :
openssl verify -CAfile /etc/mysql/newcerts/ca-cert.pem /etc/mysql/newcerts/server-cert.pem /etc/mysql/newcerts/client-cert.pem
Then, you must follow MySQL requierements to generate proper keys and certificats , especially about Common Name values that must differ : https://dev.mysql.com/doc/refman/8.0/en/creating-ssl-files-using-openssl.html
Here is a way to generate those certificates, maybe not the best, but it works, according to Activ'Cloud support :
Server side :
openssl genrsa 2048 > /tmp/cert/mysqld-ca-key.pem
openssl req -sha1 -new -x509 -nodes -days 3650 -key /tmp/cert/mysqld-ca-key.pem -subj "/C=FR/ST=/L=/O=mysqld/CN=mysqld-CA" > /tmp/cert/mysqld-ca-cert.pem
openssl req -sha1 -newkey rsa:2048 -days 3650 -nodes -keyout /tmp/cert/mysqld-server-key.pem -subj "/C=FR/ST=/L=/O=mysqld/CN=mysqld-server" > /tmp/cert/mysqld-server-req.pem
openssl rsa -in /tmp/cert/mysqld-server-key.pem -out /tmp/cert/mysqld-server-key.pem
openssl x509 -sha1 -req -in /tmp/cert/mysqld-server-req.pem -days 3650 -CA /tmp/cert/mysqld-ca-cert.pem -CAkey /tmp/cert/mysqld-ca-key.pem -set_serial 01 > /tmp/cert/mysqld-server-cert.pem
Client side :
openssl req -sha1 -newkey rsa:2048 -days 3650 -nodes -keyout /tmp/client-cert/mysql-client-key.pem > /tmp/client-cert/mysql-client-req.pem -subj "/C=FR/ST=/L=/O=mysql-client/CN=mysql-client"
openssl rsa -in /tmp/client-cert/mysql-client-key.pem -out /tmp/client-cert/mysql-client-key.pem
openssl x509 -sha1 -req -in /tmp/client-cert/mysql-client-req.pem -days 3650 -CA /tmp/cert/mysqld-ca-cert.pem -CAkey /tmp/cert/mysqld-ca-key.pem -set_serial 01 > /tmp/client-cert/mysql-client-cert.pem
Then copy the files generated for client and server sides in the right directories.
Lastly, you can try to force your cipherlist : https://dev.mysql.com/doc/refman/8.0/en/server-status-variables.html#statvar_Ssl_cipher_list
