MySQL Forums
Forum List  »  Security

MySQL Server 5.5.8 on Windows unable to use SSL connections
Posted by: Dave Kelly
Date: January 05, 2011 06:08PM

Running MySQL Server 5.5.8 Community GA release on Windows Server 2008 SP2. Also have OpenSSL 1.0.0 installed.

With the following in my.ini:
[mysql]
# ...
ssl = On
ssl-ca = "C:/Apache22/conf/ca/cacert.pem"
ssl-cipher = "RC4-MD5:RC4-SHA:DES-CBC-SHA:DES-CBC3-SHA:EDH-RSA-DES-CBC-SHA:EDH-RSA-DES-CBC3-SHA"
# ...
max_allowed_packet = 16M
default-character-set = "utf8"
show-warnings
# ...
[mysqld]
# ...
ssl = On
ssl-ca = "C:/ProgramData/MySQL/ca-cert.pem"
ssl-cert = "C:/ProgramData/MySQL/server-cert.pem"
ssl-key = "C:/ProgramData/MySQL/server-key.pem"
ssl-cipher = "RC4-MD5:RC4-SHA:DES-CBC-SHA:DES-CBC3-SHA:EDH-RSA-DES-CBC-SHA:EDH-RSA-DES-CBC3-SHA"
# ... etc.

Running mysql produces following error:
C:\>mysql
ERROR 2026 (HY000): SSL connection error

If I try running mysql client without the SSL options, I get:
mysql> show variables like '%ssl%';
+-------------------+
|Variable_name|Value|
+-------------------+
|have_openssl|YES|
|have_ssl|YES|
|ssl_ca|C:/ProgramData/MySQL/ca-cert.pem|
|ssl_capath||
|ssl_cert|C:/ProgramData/MySQL/server-cert.pem|
|ssl_cipher|RC4-MD5:RC4-SHA:DES-CBC-SHA:DES-CBC3-SHA:EDH-RSA-DES-CBC-SHA:EDH-RSA-DES-CBC3-SHA|
|ssl_key|C:/ProgramData/MySQL/server-key.pem|
+-------------------+
7 rows in set (0.09 sec)

Running the openssl s_client SSL testing utility (from remote client with a copy of the same CA cert) returns the following info:

C:\>openssl s_client -connect 65.168.232.6:3306 -ssl3 -state -debug -cipher RC4-MD5:RC4-SHA:DES-CBC-SHA:DES-CBC3-SHA:EDH-RSA-DES-CBC-SHA:EDH-RSA-DES-CBC3-SHA -CAfile C:/Apache22/conf/ca/cacert.pem
Loading 'screen' into random state - done
CONNECTED(00000114)
SSL_connect:before/connect initialization
write to 0x661578 [0x69e723] (63 bytes => 63 (0x3F))
0000 - 16 03 00 00 3a 01 00 00-36 03 00 4d 24 ee 92 3d ....:...6..M$..=
0010 - 8e 44 3b fa 9a 2c 7d 6f-ab 7b e0 3b dc a4 aa 57 .D;..,}o.{.;...W
0020 - 63 55 f9 30 75 46 ec 74-5e 5b 6c 00 00 0e 00 04 cU.0uF.t^[l.....
0030 - 00 05 00 09 00 0a 00 15-00 16 00 ff 02 01 ..............
003f - <SPACES/NULS>
SSL_connect:SSLv3 write client hello A
read from 0x661578 [0x69a1d3] (5 bytes => -1 (0xFFFFFFFF))
SSL_connect:error in SSLv3 read server hello A
write:errno=10054
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : SSLv3
Cipher : 0000
Session-ID:
Session-ID-ctx:
Master-Key:
Key-Arg : None
PSK identity: None
PSK identity hint: None
Start Time: 1294266002
Timeout : 7200 (sec)
Verify return code: 0 (ok)
---

Note that write:errno=10054 is the WinSock error:
// MessageId: WSAECONNRESET
// MessageText:
// An existing connection was forcibly closed by the remote host.
#define WSAECONNRESET 10054L

I've been over the settings and around the world looking for solutions, but nothing. I'm beginning to think MySQL Server can't do SSL on Windows.

Does anyone have a solution or suggestion? Perhaps I should report this as a bug...

Options: ReplyQuote


Subject
Views
Written By
Posted
MySQL Server 5.5.8 on Windows unable to use SSL connections
4621
January 05, 2011 06:08PM


Sorry, you can't reply to this topic. It has been closed.

Content reproduced on this site is the property of the respective copyright holders. It is not reviewed in advance by Oracle and does not necessarily represent the opinion of Oracle or any other party.