Secure Socket Layer for HTTPS
View All Tags
The host 127.0.0.1 does not support SSL connections means the server didn't offer TLS at all. Mine had offered it a minute before. I'd reloaded its certificates with a wrong key and NO ROLLBACK ON ERROR, which does exactly what it says: when the reload fails, TLS stays off.
TLS protocols TLSv1 and TLSv1.1 are no longer supported is a clear message, and it comes before any connection is attempted: TlsVersion in your connection string names a version the driver has dropped. Change it to what's accepted.
Asking for TLS 1.3 on a Mac gave me The requested security protocol is not supported, though MySQL and .NET 10 both support it. By default, .NET on macOS uses a TLS library that doesn't, and there's a switch to use the one that does.
Cannot determine the frame size or a corrupted frame was received sounds like a damaged network. Nothing was damaged. The driver asked for TLS 1.2, and the server only accepts TLS 1.3, and this is how that disagreement reads from the client's side.
certificate expired on 20210101000000Z is exactly what it says: the server's certificate has run out, and VerifyCA and VerifyFull refuse it. What makes this one dangerous is SslMode=Required, which keeps connecting as if nothing had happened.
I gave SslCa the right CA as a .pfx file, and the driver refused a server it should have accepted. With SslMode=VerifyCA or VerifyFull, the PFX route refused every time I tried it, on macOS and on Linux. The same CA as a .pem file worked at once.
Failed to read file at the specified location is the driver saying it can't open the file you named. The same relative path worked in one terminal and failed in another, because a relative path depends on the folder the app starts in, and that isn't always the folder you're in.
The host name does not match the name on the certificate is VerifyFull doing the one thing it adds: comparing Server= in your connection string with the names in the server's certificate. MySQL's automatic certificate has no name you could connect to, so against that certificate it can never pass.
The provided key is invalid sounds like a problem with a key file of yours. It isn't. The server's certificate was signed by a different CA that has the same name as the one in your SslCa file, and MySQL's automatic CAs all have the same name.
The certificate authority (CA) does not match means the check worked: the server's certificate wasn't signed by the CA in your SslCa file. But it caught me a second time when the right CA was in the file, because MySql.Data reads only the first certificate in it.
