Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-18277

Client can't validate server certificate if SAN name used.

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Fixed
    • 10.3.12
    • 10.2.23, 10.1.39, 10.3.14, 10.4.4
    • SSL
    • None

    Description

      I have a MariaDB 10.3.12 server configured with SSL. The SAN certificate presented by the server looks like this:

      Common Name:  server
      		 
      X509 Extensions:
      		 
         X509 v3 Subject Alternate Names:
      		 
             DNS.1:  server-01
      		 
             DNS.2:  server-01.mydomain.com
      		 
             IP.1:  10.0.0.5

      When I connect to the server using the --host option that corresponds to the DNS entry of the Common Name, the connection succeeds.

      shell

      		 
      mysql -u root --host server -p --ssl-verify-server-cert=1 --ssl-ca=/etc/pki/tls/cert.pem
      		 
      Welcome to the MariaDB monitor.  Commands end with ; or \g.
      		 
      Your MariaDB connection id is 20
      		 
      Server version: 10.3.12-MariaDB-log MariaDB Server
      		 
       
      		 
      Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
      		 
       
      		 
      Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
      		 
       
      		 
      MariaDB [(none)]>

      However, if I attempt to connect using any of the DNS entries which correspond to the SAN name, the connection fails with an SSL error.

      shell

      		 
      mysql -u root --host server-01 -p --ssl-verify-server-cert=1 --ssl-ca=/etc/pki/tls/cert.pem 
      Enter password: 
      ERROR 2026 (HY000): SSL connection error: Validation of SSL server certificate failed
      		 
       
      		 
      mysql -u root --host server-01.mydomain.com -p --ssl-verify-server-cert=1 --ssl-ca=/etc/pki/tls/cert.pem 
      Enter password: 
      ERROR 2026 (HY000): SSL connection error: Validation of SSL server certificate failed
      		 
       
      		 
      mysql -u root --host 10.0.0.5 -p --ssl-verify-server-cert=1 --ssl-ca=/etc/pki/tls/cert.pem 
      Enter password: 
      ERROR 2026 (HY000): SSL connection error: Validation of SSL server certificate failed

      There is another issue, MDEV-13102, with extremely similar symptoms which was marked as fixed for 10.1.23. I think this could be a regression on that issue, as the behavior is very similiar.

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-10594 SSL hostname verification fails for SubjectAltNames

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-15848 version_ssl_library seems to be incorrect in some cases

          • Major - Major loss of function.
          • Closed

          Task - A task that needs to be done. MDEV-18893 debuginfo packages missing from Cento{6|7}/RHEL{6|7}/sles12

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-18131 MariaDB does not verify IP addresses from subject alternative names

          • Major - Major loss of function.
          • Closed

          Activity

            People

              dbart Daniel Bartholomew
              ja391045 John Anderson
              Votes:
              1 Vote for this issue
              Watchers:
              7 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.