I am trying to get MySQL SSL replication setup for two brand new RHEL 6.6 x64 servers. I have replication working without SSL, but I can't get it set up with SSL, and can't connect directly using SSL either. I have tried connecting from both the master and the slave with mysql -h x.x.x.x -u root -p --ssl=1 --ssl-ca=ca.pem --ssl-cert=client-cert.pem --ssl-key=client-key.pem, as well as locally (Windows + MySQL Workbench), no matter what, I get:

ERROR 2026 (HY000): SSL connection error: error:00000001:lib(0):func(0):reason(1)

Since RHEL came with MySQL 5.1, I upgraded both master and slave to 5.5 per https://webtatic.com/packages/mysql55/, mysql --version for both now shows "Ver 14.14 Distrib 5.5.43, for Linux (x86_64) using readline 5.1"

Then I tried to set up SSL with self-signed certs and replication based on the tutorial at https://www.howtoforge.com/how-to-set-up-mysql-database-replication-with-ssl-encryption-on-centos-5.4

I made sure to use different Common Names for all three certificates, and openssl verify confirms that both client-cert.pem and server-cert.pem are "OK" when tested against ca.pem.

But I still get the SSL connection error above no matter what I try. No errors in the master's error log, nothing else I can see that would be causing the failure. Any help would be greatly appreciated!

Thank you.

  • Make sure the CN in the CA and Server certs are different – brent Jun 11 '15 at 16:18
  • I did, all three are different (ca.domain.com, server.domain.com, client.domain.com). – Jamin Jun 11 '15 at 16:45
  • How did you configure the server? This information is not in your question. – Michael Hampton Jun 11 '15 at 17:26
  • Configure like how? The my.cnf file? [mysqld] ... ssl ssl-ca=/etc/mysql/newcerts/ca.pem ssl-cert=/etc/mysql/newcerts/server-cert.pem ssl-key=/etc/mysql/newcerts/server-key.pem server-id = 1 log_bin = /var/log/mysql/mysql-bin.log expire_logs_days = 10 max_binlog_size = 100M – Jamin Jun 11 '15 at 18:07

Ensure the Common Name of your CA certificate and Server certificates are different

If your certificates were generated using openssl with a version greater than 1.0 and are RSA, reformat your keys using the following: openssl rsa -in key-from-openssl-1.pem -out pkcs1-yassl-compatible-key.pem (replace filenames as appropriate). The reason for this is that the key format is not compatible with yaSSL, which is what MySQL uses for SSL. Alternatively, open the pem files with an editor, and replace BEGIN PRIVATE KEY with BEGIN RSA PRIVATE KEY

  • CN's of all three certs are different (ca.domain.com, server.domain.com, client.domain.com). – Jamin Jun 11 '15 at 19:39
  • Certs were generated with openssl 1.0.1e-fips with RSA. I tried the reformat command on server-key.pem and client-key.pem, and verified that the tops and bottoms of the pem files are now showing BEGIN RSA PRIVATE KEY and END RSA PRIVATE KEY. I restarted MySQL service and tried again, still getting the same error. – Jamin Jun 11 '15 at 19:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.