The SSL hostname verification code currently fails to validate server certificates with a long Subject DN. This is due to a fixed sized buffer in the ssl_verify_server_cert function in sql-common/client.c. While this buffer length is adequate for most certificates, it is not long enough to handle the extra attributes in the Subject of EV certificates, for example...
/1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=Delaware
|
/businessCategory=Private Organization/serialNumber=2158113
|
/C=US/postalCode=94043/ST=California/L=Mountain View
|
/street=350 Ellis Street/O=Symantec Corporation
|
/OU=Cloud Platform Engineering/CN=iaasdb.dvt2.symcpe.net
|
The above Subject is 276 characters long and the CN at the end gets truncated by the static buffer size, thus the function returns a verification failure error.
$ mysql --ssl-ca=ca.pem --ssl-verify-server-cert -h iaasdb.dvt2.symcpe.net -u dbuser -p
|
Enter password:
|
ERROR 2026 (HY000): SSL connection error: SSL certificate validation failure
|
I have attached a patch that expands the buffer from 256 bytes to 1024 bytes, which will resolve the issue for all but the longest of certificate Subjects. The present method for finding the CommonName is a bad way to do things and should be overhauled, but fixing that issue is outside of the scope of this bug.
I am currently using the CentOS 7 packaged client which is version 5.5.41, but I have looked through the GitHub repository and the issue seems to exist in all current versions. The patch is based on the 5.5.42 source.
There are no comments yet on this issue.
{"report":{"fcp":880.1000001430511,"ttfb":268.7999999523163,"pageVisibility":"visible","entityId":50665,"key":"jira.project.issue.view-issue","isInitial":true,"threshold":1000,"elementTimings":{},"userDeviceMemory":8,"userDeviceProcessors":64,"apdex":1,"journeyId":"5a3a1ec5-f4a5-43c2-8ef8-7268532eee9f","navigationType":0,"readyForUser":952.7999999523163,"redirectCount":0,"resourceLoadedEnd":613.2000000476837,"resourceLoadedStart":273.7999999523163,"resourceTiming":[{"duration":9.5,"initiatorType":"link","name":"https://jira.mariadb.org/s/2c21342762a6a02add1c328bed317ffd-CDN/lu2bu7/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/css/_super/batch.css","startTime":273.7999999523163,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":273.7999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":283.2999999523163,"responseStart":0,"secureConnectionStart":0},{"duration":9.299999952316284,"initiatorType":"link","name":"https://jira.mariadb.org/s/7ebd35e77e471bc30ff0eba799ebc151-CDN/lu2bu7/820016/12ta74/8679b4946efa1a0bb029a3a22206fb5d/_/download/contextbatch/css/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true","startTime":274.10000014305115,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":274.10000014305115,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":283.40000009536743,"responseStart":0,"secureConnectionStart":0},{"duration":222.90000009536743,"initiatorType":"script","name":"https://jira.mariadb.org/s/fbf975c0cce4b1abf04784eeae9ba1f4-CDN/lu2bu7/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/js/_super/batch.js?locale=en","startTime":274.2000000476837,"connectEnd":274.2000000476837,"connectStart":274.2000000476837,"domainLookupEnd":274.2000000476837,"domainLookupStart":274.2000000476837,"fetchStart":274.2000000476837,"redirectEnd":0,"redirectStart":0,"requestStart":287.60000014305115,"responseEnd":497.10000014305115,"responseStart":309.40000009536743,"secureConnectionStart":274.2000000476837},{"duration":338.90000009536743,"initiatorType":"script","name":"https://jira.mariadb.org/s/099b33461394b8015fc36c0a4b96e19f-CDN/lu2bu7/820016/12ta74/8679b4946efa1a0bb029a3a22206fb5d/_/download/contextbatch/js/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en&slack-enabled=true","startTime":274.2999999523163,"connectEnd":274.2999999523163,"connectStart":274.2999999523163,"domainLookupEnd":274.2999999523163,"domainLookupStart":274.2999999523163,"fetchStart":274.2999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":287.90000009536743,"responseEnd":613.2000000476837,"responseStart":308.60000014305115,"secureConnectionStart":274.2999999523163},{"duration":43,"initiatorType":"script","name":"https://jira.mariadb.org/s/94c15bff32baef80f4096a08aceae8bc-CDN/lu2bu7/820016/12ta74/c92c0caa9a024ae85b0ebdbed7fb4bd7/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en","startTime":274.5,"connectEnd":274.5,"connectStart":274.5,"domainLookupEnd":274.5,"domainLookupStart":274.5,"fetchStart":274.5,"redirectEnd":0,"redirectStart":0,"requestStart":288.10000014305115,"responseEnd":317.5,"responseStart":315,"secureConnectionStart":274.5},{"duration":43.39999985694885,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2bu7/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":274.60000014305115,"connectEnd":274.60000014305115,"connectStart":274.60000014305115,"domainLookupEnd":274.60000014305115,"domainLookupStart":274.60000014305115,"fetchStart":274.60000014305115,"redirectEnd":0,"redirectStart":0,"requestStart":289.60000014305115,"responseEnd":318,"responseStart":315.60000014305115,"secureConnectionStart":274.60000014305115},{"duration":44.299999952316284,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2bu7/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":274.7000000476837,"connectEnd":274.7000000476837,"connectStart":274.7000000476837,"domainLookupEnd":274.7000000476837,"domainLookupStart":274.7000000476837,"fetchStart":274.7000000476837,"redirectEnd":0,"redirectStart":0,"requestStart":289.7999999523163,"responseEnd":319,"responseStart":316.60000014305115,"secureConnectionStart":274.7000000476837},{"duration":13.700000047683716,"initiatorType":"link","name":"https://jira.mariadb.org/s/b04b06a02d1959df322d9cded3aeecc1-CDN/lu2bu7/820016/12ta74/a2ff6aa845ffc9a1d22fe23d9ee791fc/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":274.7999999523163,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":274.7999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":288.5,"responseStart":0,"secureConnectionStart":0},{"duration":99.5,"initiatorType":"script","name":"https://jira.mariadb.org/rest/api/1.0/shortcuts/820016/47140b6e0a9bc2e4913da06536125810/shortcuts.js?context=issuenavigation&context=issueaction","startTime":274.90000009536743,"connectEnd":274.90000009536743,"connectStart":274.90000009536743,"domainLookupEnd":274.90000009536743,"domainLookupStart":274.90000009536743,"fetchStart":274.90000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":294.90000009536743,"responseEnd":374.40000009536743,"responseStart":372.7000000476837,"secureConnectionStart":274.90000009536743},{"duration":14.100000143051147,"initiatorType":"link","name":"https://jira.mariadb.org/s/3ac36323ba5e4eb0af2aa7ac7211b4bb-CDN/lu2bu7/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.css?jira.create.linked.issue=true","startTime":275,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":275,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":289.10000014305115,"responseStart":0,"secureConnectionStart":0},{"duration":44.90000009536743,"initiatorType":"script","name":"https://jira.mariadb.org/s/3339d87fa2538a859872f2df449bf8d0-CDN/lu2bu7/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.js?jira.create.linked.issue=true&locale=en","startTime":275,"connectEnd":275,"connectStart":275,"domainLookupEnd":275,"domainLookupStart":275,"fetchStart":275,"redirectEnd":0,"redirectStart":0,"requestStart":295.2000000476837,"responseEnd":319.90000009536743,"responseStart":318.10000014305115,"secureConnectionStart":275},{"duration":310.09999990463257,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2bu7/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":280.2000000476837,"connectEnd":280.2000000476837,"connectStart":280.2000000476837,"domainLookupEnd":280.2000000476837,"domainLookupStart":280.2000000476837,"fetchStart":280.2000000476837,"redirectEnd":0,"redirectStart":0,"requestStart":335.10000014305115,"responseEnd":590.2999999523163,"responseStart":585.6000001430511,"secureConnectionStart":280.2000000476837},{"duration":310.80000019073486,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2bu7/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-init/jira.webresources:bigpipe-init.js","startTime":280.2999999523163,"connectEnd":280.2999999523163,"connectStart":280.2999999523163,"domainLookupEnd":280.2999999523163,"domainLookupStart":280.2999999523163,"fetchStart":280.2999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":349.2999999523163,"responseEnd":591.1000001430511,"responseStart":587.7000000476837,"secureConnectionStart":280.2999999523163},{"duration":152.39999985694885,"initiatorType":"xmlhttprequest","name":"https://jira.mariadb.org/rest/webResources/1.0/resources","startTime":644.1000001430511,"connectEnd":644.1000001430511,"connectStart":644.1000001430511,"domainLookupEnd":644.1000001430511,"domainLookupStart":644.1000001430511,"fetchStart":644.1000001430511,"redirectEnd":0,"redirectStart":0,"requestStart":763,"responseEnd":796.5,"responseStart":795.2000000476837,"secureConnectionStart":644.1000001430511},{"duration":84.09999990463257,"initiatorType":"script","name":"https://www.google-analytics.com/analytics.js","startTime":873.6000001430511,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":873.6000001430511,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":957.7000000476837,"responseStart":0,"secureConnectionStart":0},{"duration":183.39999985694885,"initiatorType":"xmlhttprequest","name":"https://jira.mariadb.org/rest/webResources/1.0/resources","startTime":880.1000001430511,"connectEnd":880.1000001430511,"connectStart":880.1000001430511,"domainLookupEnd":880.1000001430511,"domainLookupStart":880.1000001430511,"fetchStart":880.1000001430511,"redirectEnd":0,"redirectStart":0,"requestStart":1033.5,"responseEnd":1063.5,"responseStart":1062.7999999523163,"secureConnectionStart":880.1000001430511}],"fetchStart":0,"domainLookupStart":51,"domainLookupEnd":95,"connectStart":95,"connectEnd":114,"secureConnectionStart":103,"requestStart":115,"responseStart":268,"responseEnd":275,"domLoading":271,"domInteractive":1036,"domContentLoadedEventStart":1036,"domContentLoadedEventEnd":1076,"domComplete":1403,"loadEventStart":1403,"loadEventEnd":1403,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[{"name":"bigPipe.sidebar-id.start","time":1023},{"name":"bigPipe.sidebar-id.end","time":1023.7000000476837},{"name":"bigPipe.activity-panel-pipe-id.start","time":1023.9000000953674},{"name":"bigPipe.activity-panel-pipe-id.end","time":1024.2999999523163},{"name":"activityTabFullyLoaded","time":1087.9000000953674}],"measures":[],"correlationId":"661ed241c1952","effectiveType":"4g","downlink":9.9,"rtt":0,"serverDuration":76,"dbReadsTimeInMs":15,"dbConnsTimeInMs":22,"applicationHash":"9d11dbea5f4be3d4cc21f03a88dd11d8c8687422","experiments":[]}}