I'm having difficulty with MySQL and OpenSSL. I'm running MySQL 5.7 and OpenSSL 1.1.0g on Ubuntu 16.04
Regardless of what certificates I load, MySQL starts up but does not establish a connection over SSL if the certificates are verified. For example, if I allow it to create its own certs, this is in /var/log/mysql/error.log:
2019-02-17T09:42:25.666293Z 0 [Note] Found ca.pem, server-cert.pem and server-key.pem in data directory. Trying to enable SSL support using them.
2019-02-17T09:42:25.666543Z 0 [Warning] CA certificate ca.pem is self signed.
Normal enough. But:
/usr/bin/openssl s_client -connect localhost:3306 gives me this:
140234876264896:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../ssl/record/ssl3_record.c:252:
If I create a separate CA and self-signed certs with openssl, it doesn't make any difference - same error. As a last resort I tried using my web server's LetsEncrypt certificate with the LE CA cert to avoid using a self-signed cert, with the exact same result.
Turns out any application trying to connect, like phpMyAdmin, fails with an OpenSSL error too, unless it is allowed to connect insecurely.
If I set
$cfg['Servers'][$i]['ssl_verify'] = false; in
phpMyAdmin/admin/config.inc.php it connects over SSL, but with a "not verified" warning.
From that, I think it looks like a CA error specifically, not a certificate error, but since I'm getting the same result regardless of what CA cert is configured, I'm at a loss. Any suggestions?