2

I have an Amazon RDS instance running MySQL. I've created a user account, and I've configured MySQL to require the use of SSL for all logins to that account.

I want the MySQL client to be able to authenticate the server, to ensure that man-in-the-middle attacks cannot occur. The MySQL command-line client has an option for this, namely --ssl-verify-server-cert. However, when I try it, I get the following, uninformative, error message:

  ERROR 2026 (HY000): SSL connection error

So this command works fine:

  mysql --host $RDS_host --user $username \
  --password=$password \
  --ssl-ca mysql-ssl-ca-cert.pem -e '\s'

But if I add the option --ssl-verify-server-cert, I get the error message that I've just quoted. (By the way, the CA file was obtained from https://rds.amazonaws.com/doc/mysql-ssl-ca-cert.pem.)

Is there any way to get this option to work?

In one way, it's not surprising that the option fails to work, since the Amazon documentation (use the right-hand frame) states the following:

The SSL support in Amazon RDS is strictly for encrypting the connection between your client and your DB Instance; it should not be relied on for authenticating the server.

However, I don't see where the difficulty is, from Amazon's point of view. It seems to me that it would be quite easy for them to configure their server so that I could use --ssl-verify-server-cert.

3
  • If you are connecting from EC2, it may be more efficient (i.e. simpler and less overhead) to setup a DB security group for your RDS instance and only allow access from instances in a given security group. (In that way, traffic is effectively firewalled, limiting access to the RDS instance and avoiding the SSL overhead).
    – cyberx86
    Oct 10, 2012 at 14:46
  • That would be ideal, but I don't want to force the client to have EC2 instances.
    – user140435
    Oct 10, 2012 at 14:53
  • I'd think that would mean the $RDS_host you specify is different from the Common Name that the RDS server certification uses. Maybe try to see the common name the server uses by using openssl s_client -connect $RDS_host:3306 2>/dev/null | grep CN. You could also add a couple of -v to your mysql command; maybe that would output more useful information when it fails. Jan 9, 2013 at 2:27

0

You must log in to answer this question.