Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-33430

Command line client error ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

Details

    Description

      I install recent 11.4 on Windows. I connect with the client like this

      C:\>mysql -uroot
      

      I get an surprising, absolutely incomprehensible, for an average user, message

      ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
      

      Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

      Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that additionally allows local administrators to be authenticated as "root", via auth_gssapi

      CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
      

      That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

      Correct password does not give untrusted root error, for the same, untrusted, generated certificate

      Here are 4 attempts to connect, each behaving slightly differently. Sometimes the connection fails with CERT_E_UNTRUSTEDROOT, sometimes it fails with "Access denied (using password:YES) . Sometimes it succeeds. What is the logic?

      PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql
      ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
      PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql  --password=1
      ERROR 1045 (28000): Access denied for user 'wva72'@'localhost' (using password: YES)
      PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql -uroot --password=1
      Welcome to the MariaDB monitor.  Commands end with ; or \g.
      Your MariaDB connection id is 14
      Server version: 11.4.0-MariaDB Source distribution
       
      Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
       
      Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
       
      MariaDB [(none)]> quit
      Bye
      PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql -uroot --password=2
      ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
      

      The last one should succeed, via auth_gssapi, since it is run from administrator shell, but it does not

      Attachments

        Issue Links

          Activity

            wlad Vladislav Vaintroub created issue -
            wlad Vladislav Vaintroub made changes -
            Field Original Value New Value
            Description I install recent 11.4 on Windows. I connect with the client like this
            mysql -uroot
            I get an surprise, an absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.
            I install recent 11.4 on Windows. I connect with the client like this
            mysql -uroot
            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.
            wlad Vladislav Vaintroub made changes -
            Description I install recent 11.4 on Windows. I connect with the client like this
            mysql -uroot
            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.
            I install recent 11.4 on Windows. I connect with the client like this
            mysql -uroot
            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could connect without password, or with wrong password due to
            user definition, that allows local administrators to be authenticated as "root"

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.
            wlad Vladislav Vaintroub made changes -
            Description I install recent 11.4 on Windows. I connect with the client like this
            mysql -uroot
            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could connect without password, or with wrong password due to
            user definition, that allows local administrators to be authenticated as "root"

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.
            I install recent 11.4 on Windows. I connect with the client like this
            mysql -uroot
            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could connect without password, or with wrong password due to
            user definition, that allows local administrators to be authenticated as "root"

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *even if certificate is the same*
            wlad Vladislav Vaintroub made changes -
            Description I install recent 11.4 on Windows. I connect with the client like this
            mysql -uroot
            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could connect without password, or with wrong password due to
            user definition, that allows local administrators to be authenticated as "root"

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *even if certificate is the same*
            I install recent 11.4 on Windows. I connect with the client like this
            mysql -uroot
            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could connect without password, or with wrong password due to
            user definition, that allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *even if certificate is the same*
            wlad Vladislav Vaintroub made changes -
            Description I install recent 11.4 on Windows. I connect with the client like this
            mysql -uroot
            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could connect without password, or with wrong password due to
            user definition, that allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *even if certificate is the same*
            I install recent 11.4 on Windows. I connect with the client like this
            mysql -uroot
            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *even if certificate is the same*
            wlad Vladislav Vaintroub made changes -
            Description I install recent 11.4 on Windows. I connect with the client like this
            mysql -uroot
            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *even if certificate is the same*
            I install recent 11.4 on Windows. I connect with the client like this
            mysql -uroot
            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *even if certificate is the same*
            wlad Vladislav Vaintroub made changes -
            wlad Vladislav Vaintroub made changes -
            wlad Vladislav Vaintroub made changes -
            Description I install recent 11.4 on Windows. I connect with the client like this
            mysql -uroot
            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *even if certificate is the same*
            I install recent 11.4 on Windows. I connect with the client like this
            mysql -uroot
            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that additionally allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *even if certificate is the same*
            wlad Vladislav Vaintroub made changes -
            Description I install recent 11.4 on Windows. I connect with the client like this
            mysql -uroot
            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that additionally allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *even if certificate is the same*
            I install recent 11.4 on Windows. I connect with the client like this
            mysql -uroot
            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that additionally allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *for the same, untrusted, generated certificate*
            wlad Vladislav Vaintroub made changes -
            Description I install recent 11.4 on Windows. I connect with the client like this
            mysql -uroot
            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that additionally allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *for the same, untrusted, generated certificate*
            I install recent 11.4 on Windows. I connect with the client like this

            {code:batch}
            // Some comments here
            public String getFoo()
            {
                return foo;
            }
            {code}

            C:\>mysql -uroot
            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that additionally allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *for the same, untrusted, generated certificate*
            wlad Vladislav Vaintroub made changes -
            Description I install recent 11.4 on Windows. I connect with the client like this

            {code:batch}
            // Some comments here
            public String getFoo()
            {
                return foo;
            }
            {code}

            C:\>mysql -uroot
            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that additionally allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *for the same, untrusted, generated certificate*
            I install recent 11.4 on Windows. I connect with the client like this

            {code:batch}
            C:\>mysql -uroot
            {code}

            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that additionally allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *for the same, untrusted, generated certificate*
            wlad Vladislav Vaintroub made changes -
            Description I install recent 11.4 on Windows. I connect with the client like this

            {code:batch}
            C:\>mysql -uroot
            {code}

            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that additionally allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *for the same, untrusted, generated certificate*
            I install recent 11.4 on Windows. I connect with the client like this

            {code:batch}
            C:\>mysql -uroot
            {code}

            I get an surprising, absolutely incomprehensible, for an average user, message
            {noformat}
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            {noformat}

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that additionally allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *for the same, untrusted, generated certificate*
            wlad Vladislav Vaintroub made changes -
            Description I install recent 11.4 on Windows. I connect with the client like this

            {code:batch}
            C:\>mysql -uroot
            {code}

            I get an surprising, absolutely incomprehensible, for an average user, message
            {noformat}
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            {noformat}

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that additionally allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *for the same, untrusted, generated certificate*
            I install recent 11.4 on Windows. I connect with the client like this

            {code:batch}
            C:\>mysql -uroot
            {code}

            I get an surprising, absolutely incomprehensible, for an average user, message
            {noformat}
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            {noformat}

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that additionally allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *for the same, untrusted, generated certificate*

            Here are 3 attempts to connect, each behaving slightly different. Where is the logic?
            {script}
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql --password=1
            ERROR 1045 (28000): Access denied for user 'wva72'@'localhost' (using password: YES)
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql -uroot --password=1
            Welcome to the MariaDB monitor. Commands end with ; or \g.
            Your MariaDB connection id is 14
            Server version: 11.4.0-MariaDB Source distribution

            Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

            Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

            MariaDB [(none)]> quit
            Bye
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql -uroot --password=2
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            {script}
            wlad Vladislav Vaintroub made changes -
            Description I install recent 11.4 on Windows. I connect with the client like this

            {code:batch}
            C:\>mysql -uroot
            {code}

            I get an surprising, absolutely incomprehensible, for an average user, message
            {noformat}
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            {noformat}

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that additionally allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *for the same, untrusted, generated certificate*

            Here are 3 attempts to connect, each behaving slightly different. Where is the logic?
            {script}
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql --password=1
            ERROR 1045 (28000): Access denied for user 'wva72'@'localhost' (using password: YES)
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql -uroot --password=1
            Welcome to the MariaDB monitor. Commands end with ; or \g.
            Your MariaDB connection id is 14
            Server version: 11.4.0-MariaDB Source distribution

            Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

            Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

            MariaDB [(none)]> quit
            Bye
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql -uroot --password=2
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            {script}
            I install recent 11.4 on Windows. I connect with the client like this

            {code:batch}
            C:\>mysql -uroot
            {code}

            I get an surprising, absolutely incomprehensible, for an average user, message
            {noformat}
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            {noformat}

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that additionally allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *for the same, untrusted, generated certificate*

            Here are 3 attempts to connect, each behaving slightly different. Where is the logic?
            {code:batch}
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql --password=1
            ERROR 1045 (28000): Access denied for user 'wva72'@'localhost' (using password: YES)
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql -uroot --password=1
            Welcome to the MariaDB monitor. Commands end with ; or \g.
            Your MariaDB connection id is 14
            Server version: 11.4.0-MariaDB Source distribution

            Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

            Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

            MariaDB [(none)]> quit
            Bye
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql -uroot --password=2
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            {code}
            wlad Vladislav Vaintroub made changes -
            Description I install recent 11.4 on Windows. I connect with the client like this

            {code:batch}
            C:\>mysql -uroot
            {code}

            I get an surprising, absolutely incomprehensible, for an average user, message
            {noformat}
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            {noformat}

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that additionally allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *for the same, untrusted, generated certificate*

            Here are 3 attempts to connect, each behaving slightly different. Where is the logic?
            {code:batch}
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql --password=1
            ERROR 1045 (28000): Access denied for user 'wva72'@'localhost' (using password: YES)
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql -uroot --password=1
            Welcome to the MariaDB monitor. Commands end with ; or \g.
            Your MariaDB connection id is 14
            Server version: 11.4.0-MariaDB Source distribution

            Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

            Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

            MariaDB [(none)]> quit
            Bye
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql -uroot --password=2
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            {code}
            I install recent 11.4 on Windows. I connect with the client like this

            {code:batch}
            C:\>mysql -uroot
            {code}

            I get an surprising, absolutely incomprehensible, for an average user, message
            {noformat}
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            {noformat}

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that additionally allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *for the same, untrusted, generated certificate*

            Here are 4 attempts to connect, each behaving slightly differently. Where is the logic?
            {code:batch}
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql --password=1
            ERROR 1045 (28000): Access denied for user 'wva72'@'localhost' (using password: YES)
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql -uroot --password=1
            Welcome to the MariaDB monitor. Commands end with ; or \g.
            Your MariaDB connection id is 14
            Server version: 11.4.0-MariaDB Source distribution

            Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

            Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

            MariaDB [(none)]> quit
            Bye
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql -uroot --password=2
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            {code}
            The last one should succeed, via auth_gssapi, since it is run from administrator shell, but it does not
            wlad Vladislav Vaintroub made changes -
            Description I install recent 11.4 on Windows. I connect with the client like this

            {code:batch}
            C:\>mysql -uroot
            {code}

            I get an surprising, absolutely incomprehensible, for an average user, message
            {noformat}
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            {noformat}

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that additionally allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *for the same, untrusted, generated certificate*

            Here are 4 attempts to connect, each behaving slightly differently. Where is the logic?
            {code:batch}
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql --password=1
            ERROR 1045 (28000): Access denied for user 'wva72'@'localhost' (using password: YES)
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql -uroot --password=1
            Welcome to the MariaDB monitor. Commands end with ; or \g.
            Your MariaDB connection id is 14
            Server version: 11.4.0-MariaDB Source distribution

            Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

            Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

            MariaDB [(none)]> quit
            Bye
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql -uroot --password=2
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            {code}
            The last one should succeed, via auth_gssapi, since it is run from administrator shell, but it does not
            I install recent 11.4 on Windows. I connect with the client like this
            mysql -uroot
            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that allows local administrators to be authenticated as "root", via auth_gssapi
            (MDEV-26715)

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *even if certificate is the same*
            wlad Vladislav Vaintroub made changes -
            Description I install recent 11.4 on Windows. I connect with the client like this
            mysql -uroot
            I get an surprising, absolutely incomprehensible, for an average user, message

            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that allows local administrators to be authenticated as "root", via auth_gssapi
            (MDEV-26715)

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *even if certificate is the same*
            I install recent 11.4 on Windows. I connect with the client like this

            {code:batch}
            C:\>mysql -uroot
            {code}

            I get an surprising, absolutely incomprehensible, for an average user, message
            {noformat}
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            {noformat}

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that additionally allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *for the same, untrusted, generated certificate*

            Here are 4 attempts to connect, each behaving slightly differently. Where is the logic?
            {code:batch}
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql --password=1
            ERROR 1045 (28000): Access denied for user 'wva72'@'localhost' (using password: YES)
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql -uroot --password=1
            Welcome to the MariaDB monitor. Commands end with ; or \g.
            Your MariaDB connection id is 14
            Server version: 11.4.0-MariaDB Source distribution

            Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

            Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

            MariaDB [(none)]> quit
            Bye
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql -uroot --password=2
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            {code}
            The last one should succeed, via auth_gssapi, since it is run from administrator shell, but it does not
            wlad Vladislav Vaintroub made changes -
            Description I install recent 11.4 on Windows. I connect with the client like this

            {code:batch}
            C:\>mysql -uroot
            {code}

            I get an surprising, absolutely incomprehensible, for an average user, message
            {noformat}
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            {noformat}

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that additionally allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *for the same, untrusted, generated certificate*

            Here are 4 attempts to connect, each behaving slightly differently. Where is the logic?
            {code:batch}
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql --password=1
            ERROR 1045 (28000): Access denied for user 'wva72'@'localhost' (using password: YES)
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql -uroot --password=1
            Welcome to the MariaDB monitor. Commands end with ; or \g.
            Your MariaDB connection id is 14
            Server version: 11.4.0-MariaDB Source distribution

            Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

            Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

            MariaDB [(none)]> quit
            Bye
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql -uroot --password=2
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            {code}
            The last one should succeed, via auth_gssapi, since it is run from administrator shell, but it does not
            I install recent 11.4 on Windows. I connect with the client like this

            {code:batch}
            C:\>mysql -uroot
            {code}

            I get an surprising, absolutely incomprehensible, for an average user, message
            {noformat}
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            {noformat}

            Something went wrong with self-created certificates. I think it was meant to be transparent, in usual scenarios, like connecting with "mysql -uroot". It is not that.

            Also, client started from elevated command line could, in the past, connect without password, or with wrong password due to user definition, that additionally allows local administrators to be authenticated as "root", via auth_gssapi

            {noformat}
            CREATE USER `root`@`localhost` IDENTIFIED VIA mysql_native_password USING '*E6CC90B878B948C35E92B003C792C46C58C4AF40' OR gssapi USING 'SID:BA
            {noformat}

            That does not work either, I can only connect via correct password in mysql_native_password. Wrong password (but admin user) now gives CERT_E_UNTRUSTEDROOT, where it worked in the past.

            Correct password does not give untrusted root error, *for the same, untrusted, generated certificate*

            Here are 4 attempts to connect, each behaving slightly differently. Sometimes the connection fails with CERT_E_UNTRUSTEDROOT, sometimes it fails with "Access denied (using password:YES) . Sometimes it succeeds. What is the logic?
            {code:batch}
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql --password=1
            ERROR 1045 (28000): Access denied for user 'wva72'@'localhost' (using password: YES)
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql -uroot --password=1
            Welcome to the MariaDB monitor. Commands end with ; or \g.
            Your MariaDB connection id is 14
            Server version: 11.4.0-MariaDB Source distribution

            Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

            Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

            MariaDB [(none)]> quit
            Bye
            PS C:\work\11.4\xxx\client\RelWithDebInfo> .\mysql -uroot --password=2
            ERROR 2026 (HY000): TLS/SSL error: Server certificate validation failed. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Error 0x800B0109(CERT_E_UNTRUSTEDROOT)
            {code}
            The last one should succeed, via auth_gssapi, since it is run from administrator shell, but it does not
            wlad Vladislav Vaintroub made changes -
            Assignee Sergei Golubchik [ serg ] Vladislav Vaintroub [ wlad ]
            wlad Vladislav Vaintroub made changes -
            Fix Version/s 11.4 [ 29301 ]
            wlad Vladislav Vaintroub made changes -
            Status Open [ 1 ] Confirmed [ 10101 ]
            wlad Vladislav Vaintroub made changes -
            Fix Version/s 11.4.2 [ 29633 ]
            Fix Version/s 11.4 [ 29301 ]
            Resolution Fixed [ 1 ]
            Status Confirmed [ 10101 ] Closed [ 6 ]
            wlad Vladislav Vaintroub made changes -

            People

              wlad Vladislav Vaintroub
              wlad Vladislav Vaintroub
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.