Security Practices and Solutions
View All Tags
A client can ask for TLS, but only the server can insist on it. require_secure_transport refuses any connection without it, for every account, so one wrong connection string can't quietly turn encryption off.
A private key file can start with BEGIN PRIVATE KEY or BEGIN RSA PRIVATE KEY. They hold the same key, but some software, such as the MySql.Data driver for .NET, reads only the second. One option converts it, and it's one that older guides leave out.
A server certificate needs to name the server, and today that means its Subject Alternative Name (SAN). openssl x509 -req doesn't add one unless you give it a file with the names, so here are the steps, in order.
A certificate authority is just a certificate that's allowed to sign others, plus its private key. For servers on your own network, one openssl command makes a private one. The part people get wrong is marking it as a CA, so this states that in the command.
A certificate is a small text file, but you can't read it by opening it. One openssl command tells you who it's for, who signed it, when it ends and which host names it covers, which answers most TLS questions.
The certificate is invalid was about my client certificate, the one VerifyFull needs in SslCert. I'd made it with the usual openssl req -x509, which marks a certificate as a certificate authority on a normal setup, and the driver doesn't accept a CA in that spot.
Option not supported (Parameter 'def;sslmode') looked like a typo in an option name, but def was the end of my password. A ; ends a value in a connection string, so the driver read the rest of the password as a new option, and put it in the exception message. That message can end up in your logs.
Connections using insecure transport are prohibited while --require_secure_transport=ON is the server refusing a connection with no TLS, on purpose. MySql.Data puts Authentication to host … failed in front of it, but your password is fine. Your connection string needs TLS turned on.
An account with REQUIRE X509 must present a client certificate. I gave MySql.Data the right one, in SslCert and SslKey, and got Access denied, though the mysql client got in with the same files. The driver reads those PEM files and never sends them.
Cannot determine the frame size or a corrupted frame was received sounds like a damaged network. Nothing was damaged. The driver asked for TLS 1.2, and the server only accepts TLS 1.3, and this is how that disagreement reads from the client's side.
