1

I am trying to get MySQL SSL replication setup for two brand new RHEL 6.6 x64 servers. I have replication working without SSL, but I can't get it set up with SSL, and can't connect directly using SSL either. I have tried connecting from both the master and the slave with mysql -h x.x.x.x -u root -p --ssl=1 --ssl-ca=ca.pem --ssl-cert=client-cert.pem --ssl-key=client-key.pem, as well as locally (Windows + MySQL Workbench), no matter what, I get:

ERROR 2026 (HY000): SSL connection error: error:00000001:lib(0):func(0):reason(1)

Since RHEL came with MySQL 5.1, I upgraded both master and slave to 5.5 per https://webtatic.com/packages/mysql55/, mysql --version for both now shows "Ver 14.14 Distrib 5.5.43, for Linux (x86_64) using readline 5.1"

Then I tried to set up SSL with self-signed certs and replication based on the tutorial at https://www.howtoforge.com/how-to-set-up-mysql-database-replication-with-ssl-encryption-on-centos-5.4

I made sure to use different Common Names for all three certificates, and openssl verify confirms that both client-cert.pem and server-cert.pem are "OK" when tested against ca.pem.

But I still get the SSL connection error above no matter what I try. No errors in the master's error log, nothing else I can see that would be causing the failure. Any help would be greatly appreciated!

Thank you.

Improve this question
4
  • Make sure the CN in the CA and Server certs are different
    – brent
    Jun 11, 2015 at 16:18
  • I did, all three are different (ca.domain.com, server.domain.com, client.domain.com).
    – Jamin
    Jun 11, 2015 at 16:45
  • How did you configure the server? This information is not in your question.
    – Michael Hampton
    Jun 11, 2015 at 17:26
  • Configure like how? The my.cnf file? [mysqld] ... ssl ssl-ca=/etc/mysql/newcerts/ca.pem ssl-cert=/etc/mysql/newcerts/server-cert.pem ssl-key=/etc/mysql/newcerts/server-key.pem server-id = 1 log_bin = /var/log/mysql/mysql-bin.log expire_logs_days = 10 max_binlog_size = 100M
    – Jamin
    Jun 11, 2015 at 18:07

1 Answer 1

Reset to default
1

Ensure the Common Name of your CA certificate and Server certificates are different

If your certificates were generated using openssl with a version greater than 1.0 and are RSA, reformat your keys using the following: openssl rsa -in key-from-openssl-1.pem -out pkcs1-yassl-compatible-key.pem (replace filenames as appropriate). The reason for this is that the key format is not compatible with yaSSL, which is what MySQL uses for SSL. Alternatively, open the pem files with an editor, and replace BEGIN PRIVATE KEY with BEGIN RSA PRIVATE KEY

Improve this answer
2
  • CN's of all three certs are different (ca.domain.com, server.domain.com, client.domain.com).
    – Jamin
    Jun 11, 2015 at 19:39
  • Certs were generated with openssl 1.0.1e-fips with RSA. I tried the reformat command on server-key.pem and client-key.pem, and verified that the tops and bottoms of the pem files are now showing BEGIN RSA PRIVATE KEY and END RSA PRIVATE KEY. I restarted MySQL service and tried again, still getting the same error.
    – Jamin
    Jun 11, 2015 at 19:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .