6

I am using openssl to generate ssl certificates that I am using to connect to mysql with SSL encryption. This works fine while I am connecting from the local host environement (even when I connect over the servers public IP, I have also connected successfully from the web server boxes). However, When I try to connect from my local dev machine I get an SSL errror.

When connecting from hosting platform

mysql -u metrics -p -h 45.33.x.x --ssl-key=client-key.pem --ssl-ca=ca.pem --ssl-cert=client-cert.pem
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 136 ...

When connecting from Mac dev machine, I used scp to copy the cert/key files to my dev machine

mysql -u metrics -h 45.33.x.x -p --ssl-key=client-key.pem --ssl-cert=client-cert.pem --ssl-ca=ca.pem
Enter password:
ERROR 2026 (HY000): SSL connection error: error:00000001:lib(0):func(0):reason(1)

Here is what I have done to try to solve this problem

  1. I have generated checksums of cert/key/ca on the server and local machine, they are identical
  2. I have looked at Can't connect to MySQL 5.5 with SSL server fault question neither idea solved the problem
  3. I have debugged SSL by starting the openSSL server (on the mysql server) and connecting from my local machine, once again no problems.

If it makes a difference the servers are all running ubuntu 14.04 with openSSL "OpenSSL 1.0.1f 6 Jan 2014" and I am connecting from osX 10.10.4 with openSSL "OpenSSL 1.0.2c 12 Jun 2015"

So any ideas?

Improve this question
2
  • If possible, it's worth to add the output of openssl x509 -text -in FILE for CA, server and client certificate (just mask sensitive parts like an e-mail, domain, etc.). MySQL server- and client-side config files could also help.
    – sam_pan_mariusz
    Sep 16, 2015 at 5:52
  • One thing I would try is MySQL Workbench and see if it can maybe suggest (in more detail) any network problems
    – Machavity
    Sep 16, 2015 at 16:04

2 Answers 2

Reset to default
2

This looks like a cipher related problem. Try adding the option on both server and client: --ssl-cipher=AES128-SHA. You can use any other suite present both sides in the output of openssl ciphers HIGH.

It's also possible that the MySQL client config file includes ssl-verify-server-cert option, if so remove it or (safer) use a domain name from server's certificate CN.

If it still fails you can:

  1. Sniff your connection with tcpdump or Wireshark, look at TLS handshake.
  2. Workaround the problem with stunnel or VPN.
Improve this answer
0

Without seeing certificates, it is all a wild guess.

But this one looks awfully relevant: https://dev.mysql.com/doc/refman/5.0/en/creating-ssl-files-using-openssl.html

In short, client certificate CN MUST be different from CA CN.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC 2119].

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .