CONC-846 breaks connections by IP address when ssl_ca is set (disable-ssl-verify-server-cert silently ignored)

Summary

Connector/C 3.4.10 (CONC-846, commit e8c0a16d) changed the TLS verification logic so that `disable-ssl-verify-server-cert` is silently ignored when `ssl_ca`, `ssl_capath`, `ssl_crl`, or `ssl_crlpath` is set.

This is a security hardening, but it is also a breaking change for any client that connects by IP address to a server whose certificate lacks a matching IP SAN. That includes localhost connections via ::1 or 127.0.0.1 with typical self-signed or internally-issued certificates, replication between nodes addressed by IP, and MTR's own test infrastructure.

There was no deprecation notice, no changelog entry, no migration guide, and no environment variable workaround was documented. The MARIADB_TLS_DISABLE_PEER_VERIFICATION env var only controls the default set in mysql_init() — it does not override CONC-846's new behavior when the user explicitly sets disable-ssl-verify-server-cert AND ssl_ca.

What changed in CONC-846

Three changes in commit e8c0a16d:

1. ma_pvio_tls_verify_server_cert() in libmariadb/ma_tls.c

Before:

   if (tls_allow_invalid_server_cert &&

       (!tls_fp && !tls_fp_list))

     -> skip verification

After:

   if (tls_allow_invalid_server_cert &&

       (!tls_fp && !tls_fp_list &&

        !ssl_crl && !ssl_crlpath &&

        !ssl_ca && !ssl_capath))

     -> skip verification

The addition of ssl_ca/ssl_capath/ssl_crl/ssl_crlpath to the condition means: if any of these are set, verification proceeds even when the user explicitly requested disable-ssl-verify-server-cert.

2. Auth-switch guard in plugins/auth/my_auth.c

Before: (mysql->net.tls_verify_status & MARIADB_TLS_VERIFY_TRUST)
After: (mysql->net.tls_verify_status)

Previously only CA trust failures blocked cleartext auth plugins. Now ANY verification failure does, including hostname-only failures. The error message was also changed from the specific "The certificate is NOT trusted" to the generic "Certificate verification failure", making debugging harder.

3. FIX_SSL_VERIFY_SERVER_CERT in mysql_init() (mariadb_lib.c)

A new call in mysql_init() sets the default verification state at connection initialization.

Real-world impact

The change breaks any client connection where ALL of the following are true:

• The client connects using an IP address (IPv4 or IPv6), not a DNS hostname
• ssl_ca (or ssl_capath, ssl_crl, ssl_crlpath) is configured
• The server certificate does not have an IP SAN matching the connection address
• The user relied on disable-ssl-verify-server-cert to skip hostname verification

This is common in:

• Local development: connecting to ::1 or 127.0.0.1 with self-signed certificates
• Container/Kubernetes: databases addressed by pod IP, not DNS
• Replication: CHANGE MASTER TO MASTER_HOST='<ip>' with MASTER_SSL_CA set and MASTER_SSL_VERIFY_SERVER_CERT=0
• Any deployment where disable-ssl-verify-server-cert was used as a workaround for hostname/IP mismatch while still wanting CA chain validation

IPv6 is especially affected because:

• IPv6 addresses can never match a CN (RFC 6125 restricts CN matching to DNS names)
• There is no Unix socket fallback for IPv6 loopback — you must use TCP, which means TLS is involved
• Almost no certificates include IP:::1 SANs

MTR test breakage

MTR's default_client.cnf sets both options simultaneously:

[client]

loose-disable-ssl-verify-server-cert

[mysqltest]

loose-ssl-ca=@ENV.MYSQL_TEST_DIR/std_data/cacert.pem

Before CONC-846, the first setting skipped verification. After CONC-846, the presence of ssl-ca causes verification to proceed. The test certificate (mysql-test/std_data/server-cert.pem) has CN=localhost and no SANs — no IP:::1, no IP:127.0.0.1. Tests that connect via ::1 fail hostname verification.

Failing tests:

main.ipv6
main.mysql_client_test
main.mysql_client_test_comp
main.mysql_client_test_nonblock
rpl.rpl_ip_mix
rpl.rpl_ip_mix2
rpl.rpl_ipv6

The tests pass in BuildBot because BuildBot doesn't run tests with `--ssl`.

Affected versions

12.3.3 (CC 3.4.10, released 2026-08-20) — AFFECTED
11.8.9 (CC 3.4.10, released 2026-08-19) — AFFECTED
12.3.2 (CC 3.4.9) — not affected
11.8.8 (CC 3.4.9) — not affected
10.11.x (CC 3.3.x) — not affected (3.3 branch has no CONC-846)

All future releases on branches using CC >= 3.4.10 are affected.

Suggested fixes

1. Regenerate MTR test certificates with proper SANs: DNS:localhost, IP:127.0.0.1, IP:::1
This fixes the MTR breakage without weakening security.

2. Document the behavior change in the release notes for 11.8.9 and 12.3.3. Users who relied on disable-ssl-verify-server-cert with ssl_ca need to know their connections may break on upgrade.

3. Consider whether disable-ssl-verify-server-cert should still be honored for hostname verification even when ssl_ca is set. There is a reasonable use case for wanting CA chain validation (ssl_ca) but skipping hostname verification (e.g. connecting by IP to a cert issued for a DNS name). The current behavior conflates two distinct checks:

• CA trust: "is this certificate signed by a trusted CA?"
• Hostname match: "does the certificate match the address I connected to?"
  A user setting ssl_ca wants the first check. A user setting disable-ssl-verify-server-cert wants to skip the second. CONC-846 makes the first setting override the second, which removes the
  ability to have CA validation without hostname validation.

References

CONC-846 commit:
https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02

Connector/C 3.4.10 tag:
https://github.com/mariadb-corporation/mariadb-connector-c/tree/v3.4.10

MTR default_client.cnf:
https://github.com/MariaDB/server/blob/mariadb-12.3.3/mysql-test/include/default_client.cnf

MTR test certificate (CN=localhost, no SANs):
https://github.com/MariaDB/server/blob/mariadb-12.3.3/mysql-test/std_data/server-cert.pem

DEFAULT_SSL_VERIFY_SERVER_CERT cmake option (ON by default):
https://github.com/mariadb-corporation/mariadb-connector-c/blob/v3.4.10/CMakeLists.txt#L74

Related tickets:
MDEV-31857 — --ssl-verify-server-cert default ON (fixed in 11.4.1)
MDEV-18131 — MariaDB does not verify IP addresses from SANs
MDEV-10594 — SSL hostname verification fails for SubjectAltNames

This bug analysis and report was assisted by AI, after several IPv6 MTR tests failures were encountered during rebase preparation of MariaDB downstream Fedora packages.