Details
Critical Description
if the server is started with --ssl but without properly configured certificates, it will advertise the ssl support in the handshake, but will not actually be able to use it. so a client with --ssl will fail to connect with the ssl error (e.g. "sslv3 alert handshake failure" in OpenSSL).
I think the server should not start if it was requested to use ssl, but it cannot actually do it.
Attachments
Issue Links
- causes
-
MDEV-30270 ssl_cipher on Non-SSL system results in confusing SSL error
-
- Open
-
-
-
- Closed
-
Activity
What constitutes properly configured SSL certs? I have attached the config, docker-compose.yml and file system persmissions including a check on the certs that I created and so far I haven't been able to bring up the server with ssl support. Please help. Thanks 
docker-compose.yml
root@93aa8e176fec:/# ls -la /run |grep secrets
drwxr-xr-x 2 root root 4096 Jan 19 17:32 secrets
root@93aa8e176fec:/# ls -la /run/secrets/
total 28
drwxr-xr-x 2 root root 4096 Jan 19 17:32 .
drwxr-xr-x 1 root root 4096 Jan 19 17:32 ..
r------- 1 1000 1000 2122 Jan 19 02:05 ca-cert.pem
r------- 1 1000 1000 16 Jan 19 02:05 db_password.txt
r------- 1 1000 1000 2029 Jan 19 02:05 server-cert.pem
r------- 1 1000 1000 1704 Jan 19 02:05 server-key.pem
root@93aa8e176fec:/#
~/git/pri-fidoiot/component-samples/demo/db/secrets$ openssl verify -CAfile ca-cert.pem server-cert.pem api-user.pem
server-cert.pem: OK
api-user.pem: OK
The error message I'm getting when mariadbd is launched is:
db_1 | 2023-01-19 17:37:14 0 [ERROR] Failed to setup SSL
db_1 | 2023-01-19 17:37:14 0 [ERROR] SSL error: SSL_CTX_set_default_verify_paths failed
db_1 | 2023-01-19 17:37:14 0 [ERROR] Aborting
Hi uhofemeier!
This is probably not the best place to ask for help since only people subscribed to this issue will receive your questions (that's 5 person currently).
Also, jira.mariadb.org is normally used to report issue and it does not seem to be the case here (probably a mis-configuration).
So, in the future, I encourage you to ask for help via Zulip or via the Mailing list:
See also https://mariadb.org/contribute/#entry-header
My best guess from the error above is that there is a PATH problem with your certificates, if you log into the mariadb container (probably something like `docker exec -it db bash`, can you make sure that certs PATH are correct and that the user that runs mysql can access them (probably mysql)?
OK to push