I'm having difficulty with MySQL and OpenSSL. I'm running MySQL 5.7 and OpenSSL 1.1.0g on Ubuntu 16.04

Regardless of what certificates I load, MySQL starts up but does not establish a connection over SSL if the certificates are verified. For example, if I allow it to create its own certs, this is in /var/log/mysql/error.log:

2019-02-17T09:42:25.666293Z 0 [Note] Found ca.pem, server-cert.pem and server-key.pem in data directory. Trying to enable SSL support using them.

2019-02-17T09:42:25.666543Z 0 [Warning] CA certificate ca.pem is self signed.

Normal enough. But: /usr/bin/openssl s_client -connect localhost:3306 gives me this:


140234876264896:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../ssl/record/ssl3_record.c:252:

If I create a separate CA and self-signed certs with openssl, it doesn't make any difference - same error. As a last resort I tried using my web server's LetsEncrypt certificate with the LE CA cert to avoid using a self-signed cert, with the exact same result.

Turns out any application trying to connect, like phpMyAdmin, fails with an OpenSSL error too, unless it is allowed to connect insecurely.

If I set $cfg['Servers'][$i]['ssl_verify'] = false; in phpMyAdmin/admin/config.inc.php it connects over SSL, but with a "not verified" warning.

From that, I think it looks like a CA error specifically, not a certificate error, but since I'm getting the same result regardless of what CA cert is configured, I'm at a loss. Any suggestions?

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.