I have an Amazon RDS instance running MySQL. I've created a user account, and I've configured MySQL to require the use of SSL for all logins to that account.
I want the MySQL client to be able to authenticate the server, to ensure that man-in-the-middle attacks cannot occur. The MySQL command-line client has an option for this, namely --ssl-verify-server-cert. However, when I try it, I get the following, uninformative, error message:
ERROR 2026 (HY000): SSL connection error
So this command works fine:
mysql --host $RDS_host --user $username \ --password=$password \ --ssl-ca mysql-ssl-ca-cert.pem -e '\s'
But if I add the option --ssl-verify-server-cert, I get the error message that I've just quoted. (By the way, the CA file was obtained from https://rds.amazonaws.com/doc/mysql-ssl-ca-cert.pem.)
Is there any way to get this option to work?
In one way, it's not surprising that the option fails to work, since the Amazon documentation (use the right-hand frame) states the following:
The SSL support in Amazon RDS is strictly for encrypting the connection between your client and your DB Instance; it should not be relied on for authenticating the server.
However, I don't see where the difficulty is, from Amazon's point of view. It seems to me that it would be quite easy for them to configure their server so that I could use --ssl-verify-server-cert.
$RDS_host
you specify is different from the Common Name that the RDS server certification uses. Maybe try to see the common name the server uses by usingopenssl s_client -connect $RDS_host:3306 2>/dev/null | grep CN
. You could also add a couple of -v to your mysql command; maybe that would output more useful information when it fails.