Details
-
Task
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
None
Description
There are various bugs open about TLS connection issues in Debian and Ubuntu:
https://bugs.launchpad.net/ubuntu/+source/mariadb-10.3/+bug/1885632
- MariaDB 10.3 as provided by Ubuntu.org is compiled against YaSSL version 2.4.4, which supports a maximum TLS version of 1.1. The Ubuntu 20.04 release has a minimum TLS 1.2 requirement, rendering all MariaDB TLS connections unusable.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=921151
- appears that the Debian client is only attempting to negotiate a connection with TLSv1.1, which is blacklisted
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=927289
- Apparently YaSSL (now WolfSSL) did not support any other certificate format than PEM, and the error message is uninformative
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956401
- Option --ssl-verify-server-cert did not work. Possibly because of
MDEV-12190: YaSSL's highest supported version is TLSv1.1 (=3.2) - if the client requests a higher version, it needs to be downgraded in Server Hello packet to TLSv1.1 instead of interrupting the handshake and closing the connection.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956810
- libmariadb3 compiled libdbd-mysql failed to connect to MySQL server that required TLS
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=875457
- clients could not connect using ssl (the error message was: ERROR 2026 (HY000): SSL connection error: protocol version mismatch)
The biggest problem right now is that we don't know the status of these issues.
We should extend the debian/salsa-ci.yml to do a simple TLS scenario and test the connection so we know if it even works in the most basic case.
Attachments
Issue Links
- relates to
-
MDEV-19268 TLS Setup Documentation
- Open