3

I' am trying to connect to my AWS RDS MySQL instance with terminal on OSX El Captain, but I keep getting this error:

ERROR 2026 (HY000): SSL connection error: error:00000001:lib(0):func(0):reason(1)

This is a fresh OSX install, and I used brew to install mysql along with openssl, I can connect to the local server. Also it seems MySQL workbench works perfectly fine.

My Ubuntu machine connects to the RDS instance fine as well through terminal.

2

I had the same problem and figured it out-ish! brew most likely installed mysql 5.7 which, from what I can gather, requires ssl unless other wise specified by --skip-ssl. You can uninstall mysql by running brew uninstall mysql and then install 5.5 by running brew install https://raw.githubusercontent.com/Homebrew/homebrew-versions/master/mysql55.rb && brew link homebrew/versions/mysql55 --force.

Granted, this doesn't solve the problem of getting the initial error fixed, but I haven't found any documentation as to why 5.7 differs from 5.5 in such a way fresh out of the box. Best of luck to you!

Edit: Aha! Here's the documentation:

--ssl

For the MySQL server, this option specifies that the server permits but does not require SSL connections. The option is enabled on the server side by default as of MySQL 5.7.5, and disabled before 5.7.5. Also as of MySQL 5.7.5, MySQL servers compiled using OpenSSL can generate missing SSL files automatically at startup. See Section 6.3.13.1, “Creating SSL and RSA Certificates and Keys using MySQL”.

Edit 2:

Another option, instead of downgrading to 5.5, you can open up (or create) /etc/my.cnf or /etc/mysql/my.cnf and add the following with your existing mysql > 5.7.5:

[client]
ssl=0

This will disabled ssl on client connections and behave like mysql < 5.7.5.

  • 1
    In the spirit of homebrew, you can also put your my.cnf file in /usr/local/etc. (This didn't work for me as /usr/local/etc/mysql/my.cnf, however.) – Derek Shockey Dec 9 '15 at 21:22
0

--skip-ssl (or --ssl-mode=DISABLED for MySQL 8.0) doesn't solve that problem, it only bypasses it.

The error occures when the SSL handshake encountered an error, MySQL lacks of details about that, and this is an opened bug : https://bugs.mysql.com/bug.php?id=75311

You should first check your certificates :

openssl verify -CAfile /etc/mysql/newcerts/ca-cert.pem /etc/mysql/newcerts/server-cert.pem /etc/mysql/newcerts/client-cert.pem

Then, you must follow MySQL requierements to generate proper keys and certificats , especially about Common Name values that must differ : https://dev.mysql.com/doc/refman/8.0/en/creating-ssl-files-using-openssl.html

Here is a way to generate those certificates, maybe not the best, but it works, according to Activ'Cloud support :

Server side :

openssl genrsa 2048 > /tmp/cert/mysqld-ca-key.pem
openssl req -sha1 -new -x509 -nodes -days 3650 -key /tmp/cert/mysqld-ca-key.pem -subj "/C=FR/ST=/L=/O=mysqld/CN=mysqld-CA" > /tmp/cert/mysqld-ca-cert.pem
openssl req -sha1 -newkey rsa:2048 -days 3650 -nodes -keyout /tmp/cert/mysqld-server-key.pem -subj "/C=FR/ST=/L=/O=mysqld/CN=mysqld-server" > /tmp/cert/mysqld-server-req.pem
openssl rsa -in /tmp/cert/mysqld-server-key.pem -out /tmp/cert/mysqld-server-key.pem
openssl x509 -sha1 -req -in /tmp/cert/mysqld-server-req.pem -days 3650 -CA /tmp/cert/mysqld-ca-cert.pem -CAkey /tmp/cert/mysqld-ca-key.pem -set_serial 01 > /tmp/cert/mysqld-server-cert.pem

Client side :

openssl req -sha1 -newkey rsa:2048 -days 3650 -nodes -keyout /tmp/client-cert/mysql-client-key.pem > /tmp/client-cert/mysql-client-req.pem -subj "/C=FR/ST=/L=/O=mysql-client/CN=mysql-client"
openssl rsa -in /tmp/client-cert/mysql-client-key.pem -out /tmp/client-cert/mysql-client-key.pem
openssl x509 -sha1 -req -in /tmp/client-cert/mysql-client-req.pem -days 3650 -CA /tmp/cert/mysqld-ca-cert.pem -CAkey /tmp/cert/mysqld-ca-key.pem -set_serial 01 > /tmp/client-cert/mysql-client-cert.pem                                                                                                                                                                                                    

Then copy the files generated for client and server sides in the right directories.

Lastly, you can try to force your cipherlist : https://dev.mysql.com/doc/refman/8.0/en/server-status-variables.html#statvar_Ssl_cipher_list

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.