Security Practices and Solutions
View All Tags
certificate expired on 20210101000000Z is exactly what it says: the server's certificate has run out, and VerifyCA and VerifyFull refuse it. What makes this one dangerous is SslMode=Required, which keeps connecting as if nothing had happened.
I gave SslCa the right CA as a .pfx file, and the driver refused a server it should have accepted. With SslMode=VerifyCA or VerifyFull, the PFX route refused every time I tried it, on macOS and on Linux. The same CA as a .pem file worked at once.
The host name does not match the name on the certificate is VerifyFull doing the one thing it adds: comparing Server= in your connection string with the names in the server's certificate. MySQL's automatic certificate has no name you could connect to, so against that certificate it can never pass.
The provided key is invalid sounds like a problem with a key file of yours. It isn't. The server's certificate was signed by a different CA that has the same name as the one in your SslCa file, and MySQL's automatic CAs all have the same name.
The certificate authority (CA) does not match means the check worked: the server's certificate wasn't signed by the CA in your SslCa file. But it caught me a second time when the right CA was in the file, because MySql.Data reads only the first certificate in it.
The key was good, and MySQL had made it itself, yet the driver said The specified file cannot be converted to a key. It isn't the key, it's the wrapping: MySql.Data reads only one of the two formats that OpenSSL writes, and it isn't the one you get today by default.
SslMode=VerifyCA worked. Moving up to VerifyFull, which only adds a check of the server's name, failed with a complaint about a client certificate I'd never needed. The driver insists on one with PEM files, and then it never sends it.
I raised SslMode from Required to VerifyCA and the connection stopped working, with No file path has been provided for the connection option SslCa. VerifyCA means "check who signed the server's certificate", so the driver needs to know which signature to trust, and it only looks in the file you give it.
The password was right, and I still got ERROR 1045 (28000): Access denied. MySQL gives no hint of the real reason: this account has REQUIRE SSL, and the connection didn't use TLS. It caught me over a local socket too, which require_secure_transport would have allowed.
Connections using insecure transport are prohibited while --require_secure_transport=ON means the server refuses anything unencrypted, and this connection is. Turn TLS on in the client: it's usually one option.
