MySQL SSL: SSL_CTX_set_default_verify_paths failed

Question

I have been trying for a few days in get SSL working with MySQL.

This is the setup I currently have:

MySQL 5.7.17-0ubuntu0.16.04.1

This is the error I am receiving when I start MySQL Server

Failed to set up SSL because of the following SSL library error: SSL_CTX_set_default_verify_paths failed

Configuration File:

sl-ca = /etc/mysql-ssl/ca-cert.pem
ssl-cert = /etc/mysql-ssl/server-cert.pem
ssl-key = /etc/mysql-ssl/server-key.pem
ssl

I read this post, Chown the files, checked to see if SELinux was enabled (not installed)

I have also ran these commands and get the following responses:

sudo -u mysql cat /etc/mysql-ssl/ca-cert.pem
-----BEGIN CERTIFICATE-----

sudo -u mysql cat /etc/mysql-ssl/server-cert.pem
-----BEGIN CERTIFICATE-----

sudo -u mysql cat /etc/mysql-ssl/server-key.pem
-----BEGIN RSA PRIVATE KEY-----

At this point I am running out of ideas on where to turn next. Can anybody point me in the right direction.

Answer 1

1. Using your valide system/service account for your database (mysql)
2. set owner to this database-service-account (mysql)
3. check the path valide
4. check the openssl certs
5. set correct and usefull access rights (mind. 0660 because of non executible files)
6. check for selinux or apparmor settings! they can block the access!

The following should show file information and set correct user and RW-Rights run as root or add sudo to begin of every :

echo # show all entries of my.cnf (should 4 without # also wrong config settings)
cat /etc/mysql/my.cnf | grep ssl;
echo # Folder checkup (should list your PEM-Files)
ls -al /etc/mysql-ssl/;
echo # set all PEM-Files to user mysql
chown -R mysql:root /etc/mysql-ssl/*.pem
echo # set all PEM-Files to read-only from User (oder or use 660 )
chmod -R 600 /etc/mysql-ssl/*.pem
echo # restart mariaDB wait 5 secounds and show SSL errors
service mysql restart; sleep 5; service mysql status | grep SSL_CTX_set_default_verify_paths

I've created a separate group (ssl-certs) on my Ubuntu server, added mysql to that group and set all the rights (both folders - 0750 /files - 0640) accordingly. If you want to make sure, that mysql can access the files, you can su to mysql and check (as root).

su --shell=/bin/bash mysql
ls -la /path/cert/is/

Don't forget to check all paths: CA, cert, private key.

Answer 2

sl-ca = /etc/mysql-ssl/ca-cert.pem should be ssl-ca = /etc/mysql-ssl/ca-cert.pem

Answer 3

Hope this helps someone else, I needed a restart of apache after putting all the files on disk and setting all the right permissions.

Answer 4

As pointed out from an another user, there are errors in the configuration file!

As better explained here: server-system-variables the parameters in the configuration file should be:

ssl_ca instead of sl-ca
ssl_cert instead of ssl-cert
ssl_key instead of ssl-key

Answer 5

For anybody else who may encounter this problem. I moved the files into the MySQL folder, set the Owner as root and permissions as 777.