With OpenSSL 4.1.0 the MTR server certificate no longer verifies for localhost:

$ openssl version

OpenSSL 4.1.0 23 Oct 2026 (Library: OpenSSL 4.1.0 23 Oct 2026)

$ openssl x509 -in mysql-test/std_data/server-cert.pem -noout -checkhost localhost

Hostname localhost does NOT match certificate

$ /opt/homebrew/opt/openssl@3/bin/openssl version

OpenSSL 3.5.9 29 Sep 2026 (Library: OpenSSL 3.5.9 29 Sep 2026)

$ /opt/homebrew/opt/openssl@3/bin/openssl x509 -in mysql-test/std_data/server-cert.pem -noout -checkhost localhost

Hostname localhost does match certificate

In a server built against 4.1.0 (-DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl@4), main.ssl_7937 'ssl' fails like this:

@@ -9,8 +9,7 @@

 mysql --ssl-ca=cacert.pem --ssl-verify-server-cert -e "call test.have_ssl()"

-have_ssl

-yes

+ERROR 2026 (HY000): TLS/SSL error: Hostname verification failed

main.ssl_system_ca 'good' fails with the same error. rpl.rpl_ssl1 times out in wait_for_slave_to_start after CHANGE MASTER TO master_host="localhost", ..., master_ssl_verify_server_cert=1, and the replica error log has

[ERROR] Slave I/O: error connecting to master 'root@localhost:19000' - retry-time: 1  maximum-retries: 30  message: SSL connection error: SSL certificate validation failure, Internal MariaDB error code: 2026

std_data/server-cert.pem names its host only in the subject, as CN=localhost. Both clients check the host with X509_check_host(cert, host, len, 0, NULL). Connector/C does it in libmariadb/secure/openssl.c and the replica in ssl_verify_server_cert() in sql-common/client.c. OpenSSL 4.1.0 compares the host with the subject CN only when the caller passes X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT. Earlier versions fell back to the CN when the certificate had no DNS subjectAltName. The change is in the 4.1.0 CHANGES.md under "Changes between 4.0 and 4.1.0", https://github.com/openssl/openssl/pull/31982.

Proposed fix:

• Sign server-cert.pem again from the existing server-key.pem and cacert.pem with subjectAltName=DNS:localhost. Keep the subject, issuer, serial 01 and validity dates.
• Add the extension to the server certificate step in mysql-test/lib/generate-ssl-certs.sh.
• Update the SHA1 fingerprint that main.ssl_fp passes to --ssl-fp. This is the only test change.

With the fix, main.ssl_7937, main.ssl_system_ca, rpl.rpl_ssl1, main.ssl_fp and main.ssl pass against 4.1.0.