4

This concerns my attempt to use a client side certificate on an SSL encrypted connection to a mysql server.

Some basics: Server is ubuntu 12.04 running mysql 14.14 Distrib 5.1.69. Client is MacOS 10.8.5 with mysql Ver 14.14 Distrib 5.5.25a

There are many ways to get this setup wrong, as witnessed by many posting here and elsewhere on the web. In this case, it appears the server side is configured correctly, as it is possible to use a command like

mysql --ssl-ca=CAcert.pem -u user -ppassword -h host.com -e '\s

to obtain a report that there is a cipher in use.

If however I add a client side certificate and key, like

mysql --ssl-ca=CAcert.pem --ssl-cert=clientCert.pem --ssl-key=keyFile -u user -ppassword -h host.com -e '\s'

this produces the very non-informative error message 'ERROR 2026 (HY000): SSL connection error: error:00000001:lib(0):func(0):reason(1)'. There is nothing in the server error log.

I have checked that the client certificate can be verified for the CA in use with openssl verify -purpose sslclient -CAfile CAcert.pem clientCert.pem

which returns ok.

The canonical names of the CAcert.pem and clientCert.pem are distinct. The CAcert.pem, clientCert.pem, and keyFile are all readable by the user (and even making the key world readable doesn't help).

Unfortunately, given the protocol used by mysql between client and server, it doesn't appear possible to use openssl client to do any debugging here.

Any suggestions on what the problem is? Or ways to obtain more debugging information on the client side?

Improve this question
2
  • Are both the client and server using the same CAfile certificate? You should try connecting with openssl's s_client function and see where it breaks out. That error sounds like it drops before it actually gets to the mysql protocol portion.
    – Andrew Domaszek
    Sep 21, 2013 at 3:56
  • Yes, they have the same CAcert.pem. As noted above, openssl s_client doesn't work for debugging because of the protocol used by mysql. So far I haven't been able to get the client side certificates working with the command line mysql client, though providing only the -ssl-ca certificate results in an encrypted connection but no checks on the client certificate.
    – user1204270
    Oct 10, 2013 at 22:06

1 Answer 1

Reset to default
1

Whatever method you use to generate the certificate and key files, the Common Name value used for the server and client certificates/keys must each differ from the Common Name value used for the CA certificate. Otherwise, the certificate and key files do not work for servers compiled using OpenSSL. A typical error in this case is:

ERROR 2026 (HY000): SSL connection error: error:00000001:lib(0):func(0):reason(1)

source: https://dev.mysql.com/doc/refman/5.7/en/creating-ssl-files-using-openssl.html

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.