I am attempting to initialize a new MariaDB Galera cluster with SSL-encrypted replication.

I have followed this guide to the letter, specified different details for CA, Server, and Client certificates (I read there can be issues when they are exactly the same), and placed my certificate files in /etc/mysql/ssl/.

root@server:/etc/mysql/ssl# openssl verify -CAfile ca-cert.pem server-cert.pem client-cert.pem
server-cert.pem: OK
client-cert.pem: OK

These are my SSL-related settings:

ssl-ca = /etc/mysql/ssl/ca-cert.pem
ssl-key = /etc/mysql/ssl/server-key.pem
ssl-cert = /etc/mysql/ssl/server-cert.pem

ssl-ca = /etc/mysql/ssl/ca-cert.pem
ssl-key = /etc/mysql/ssl/client-key.pem
ssl-cert = /etc/mysql/ssl/client-cert.pem

When I try to start my first node with service mysql start --wsrep-new-cluster, I get the following errors:

2016-02-02 14:01:25 140601166120896 [ERROR] WSREP: Bad value '/etc/mysql/ssl/server-key.pem' for SSL parameter 'socket.ssl_key': : 22 (Invalid argument)
     at galerautils/src/gu_asio.cpp:ssl_prepare_context():148
2016-02-02 14:01:25 140601166120896 [ERROR] WSREP: wsrep::init() failed: 7, must shutdown
2016-02-02 14:01:25 140601166120896 [ERROR] Aborting

I found the code throwing that error, but it didn't help me find the cause of the issue.

I am using MariaDB 10.1.11 with Galera 25.3.12.

  • 1
    Check if mysqld has sufficient permission to access server-key.pem. – Nirbhay Choubey Feb 3 '16 at 16:38
  • Good grief. That was it. chmod 500 /etc/mysql/ssl/ && chmod 400 /etc/mysql/ssl/* && chown -R mysql:mysql /etc/mysql/ssl/ = fixed. – Andrew Ensley Feb 3 '16 at 18:12

My permissions were off. This fixed it:

root@server:/etc/mysql# chmod 500 /etc/mysql/ssl/
root@server:/etc/mysql# chmod 400 /etc/mysql/ssl/*
root@server:/etc/mysql# chown -R mysql:mysql /etc/mysql/ssl/
|improve this answer|||||

Fix permissions doesn't work in my case, i have to active permissive mode for mysqld_t semanage permissive -a mysqld_t


allow mysqld_t admin_home_t:file { getattr open read };
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.