I have been trying for a few days in get SSL working with MySQL.

This is the setup I currently have:

MySQL 5.7.17-0ubuntu0.16.04.1

This is the error I am receiving when I start MySQL Server

Failed to set up SSL because of the following SSL library error: SSL_CTX_set_default_verify_paths failed

Configuration File:

sl-ca = /etc/mysql-ssl/ca-cert.pem
ssl-cert = /etc/mysql-ssl/server-cert.pem
ssl-key = /etc/mysql-ssl/server-key.pem

I read this post, Chown the files, checked to see if SELinux was enabled (not installed)

I have also ran these commands and get the following responses:

sudo -u mysql cat /etc/mysql-ssl/ca-cert.pem

sudo -u mysql cat /etc/mysql-ssl/server-cert.pem

sudo -u mysql cat /etc/mysql-ssl/server-key.pem

At this point I am running out of ideas on where to turn next. Can anybody point me in the right direction.

5 Answers 5

  1. Using your valide system/service account for your database (mysql)
  2. set owner to this database-service-account (mysql)
  3. check the path valide
  4. check the openssl certs
  5. set correct and usefull access rights (mind. 0660 because of non executible files)
  6. check for selinux or apparmor settings! they can block the access!

The following should show file information and set correct user and RW-Rights run as root or add sudo to begin of every :

echo # show all entries of my.cnf (should 4 without # also wrong config settings)
cat /etc/mysql/my.cnf | grep ssl;
echo # Folder checkup (should list your PEM-Files)
ls -al /etc/mysql-ssl/;
echo # set all PEM-Files to user mysql
chown -R mysql:root /etc/mysql-ssl/*.pem
echo # set all PEM-Files to read-only from User (oder or use 660 )
chmod -R 600 /etc/mysql-ssl/*.pem
echo # restart mariaDB wait 5 secounds and show SSL errors
service mysql restart; sleep 5; service mysql status | grep SSL_CTX_set_default_verify_paths

I've created a separate group (ssl-certs) on my Ubuntu server, added mysql to that group and set all the rights (both folders - 0750 /files - 0640) accordingly. If you want to make sure, that mysql can access the files, you can su to mysql and check (as root).

su --shell=/bin/bash mysql
ls -la /path/cert/is/

Don't forget to check all paths: CA, cert, private key.


sl-ca = /etc/mysql-ssl/ca-cert.pem should be ssl-ca = /etc/mysql-ssl/ca-cert.pem


Hope this helps someone else, I needed a restart of apache after putting all the files on disk and setting all the right permissions.


As pointed out from an another user, there are errors in the configuration file!

As better explained here: server-system-variables the parameters in the configuration file should be:

ssl_ca instead of sl-ca
ssl_cert instead of ssl-cert
ssl_key instead of ssl-key


For anybody else who may encounter this problem. I moved the files into the MySQL folder, set the Owner as root and permissions as 777.

  • 10
    How are you going to fix your new problem (security related private files being made world readable)?
    – user143703
    Mar 23, 2017 at 2:11
  • Useless to worry about if the server doesn't work. I guess you have to dockerize the server or only use it for mysql. Mar 30, 2021 at 20:16
  • However 660 should be enough, and this does not work for me, as I suspect the error relates to a different path. Mar 30, 2021 at 20:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .