1

I have a MySQL Server set up to use SSL and I also have the CA Certificate.

When I connect to the server using MySQL Workbench, I do not need the certificate. I can also connect to the server using Python and MySQLdb on a Mac without the CA-certificate.

But when I try to connect using the exact same setup of Python and MySQLdb on a windows machine, I get access denied. It appears that I need the CA. And when I enter the CA, I get the following error

_mysql_exceptions.OperationalError: (2026, 'SSL connection error')

My code to open the connection is below:

db = MySQLdb.connect(host="host.name",    
                 port=3306,
                 user="user",         
                 passwd="secret_password",  
                 db="database", 
                 ssl={'ca': '/path/to/ca/cert'})  

Could anyone point out what the problem is on a windows? I believe it has to do with OpenSSL and Python. I installed OpenSSL from here. But I don't think Python is using this version that I installed, since when I print the version using Python, it's not the same.

This is what Python prints. It is still not a very old version and should have worked when connecting to MySQL

OpenSSL 1.0.2j 26 Sep 2016

I am really not used to having to work with OpenSSL and its issues. I've literally tried all the solutions found on google by searching the error I get, and you would think one of them should work. But none did and hence I'm guessing the problem is with the OpenSSL and Python on my system. Anyone know how I should try to at least identify the exact problem?

I also do not understand how I can connect to the MySQL Server without the CA Certificate using a Mac/Python or MySQL Workbench, but I get an access denied error in Windows using Python :/

UPDATE:

Python version 2.7.13

MySQL Server Enterprise version 5.7.18

5
  • Could you give more information about Python and MySQL version. Jul 17, 2017 at 17:25
  • @AlexanderT I added them in the update Jul 17, 2017 at 17:29
  • Have you checked solution for disabling SSL in MySQL from this answer? Jul 18, 2017 at 21:17
  • Yes, I can connect with SSL disabled. But what's the point? I need to be able to connect with SSL enabled. Jul 18, 2017 at 21:29
  • Hello! Did you find any solution to this? Dec 18, 2018 at 14:10

2 Answers 2

0

I believe that you have to set not only ssl "ca" but "cert" and "key" as well:

db = MySQLdb.connect(host="host.name",    
                 port=3306,
                 user="user",         
                 passwd="secret_password",  
                 db="database", 
                 ssl={'ca': '/path/to/ca/cert',
                      'key': '/path/to/key',
                      'cert': '/path/to/cert'}) 
4
  • I have not created the server, the credentials and certificate were given to me for my job, and I am provided with only the CA file. Do you say that it is required that all three certificate files be used with SSL? Jul 17, 2017 at 18:49
  • I might be wrong, but I assume there are server side key and cert, and client side key and cert, did you try to generate your client side cert and key using the CA cert you have?
    – Mike
    Jul 17, 2017 at 19:02
  • To generate client side certs, I need the CA Key as well which I don't have Jul 17, 2017 at 20:12
  • @Silencer310 is correct! PHP does not require a key and a cert to establish connection. Dec 18, 2018 at 14:11
0

I solved this using the official MySQL connector to Python, following the instructions in this link: https://dev.mysql.com/doc/connector-python/en/

It has an argument ssl_ca which accepts the CA and everything run OK.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .