Uploaded image for project: 'MariaDB Connector/ODBC'
  1. MariaDB Connector/ODBC
  2. ODBC-421

Certificate verification option should be on by default

Details

    • Task
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Fixed
    • None
    • 3.2.2
    • General
    • None

    Description

      Connector/C 3.4 (and new server versions) makes MYSQL_OPT_SSL_VERIFY_SERVER_CERT to be a default option. C/ODBC 3.2 is gonna be built on top of C/C 3.4, it makes sense to have the same defaults as new C/C and server versions.

      This option be used by default can cause problems with some older server versions, for which users have to explicitly reset that option.

      Attachments

        Issue Links

          causes

          Bug - A problem which impairs or prevents the functions of the product. ODBC-442 "Verify certificate" checkbox in TLS options of the setup dialog gets checket by default

          • Major - Major loss of function.
          • Closed
          is caused by

          New Feature - A new feature of the product, which has yet to be developed. MDEV-31857 enable --ssl-verify-server-cert by default

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            Lawrin Lawrin Novitsky added a comment -

            If application is requesting encrypted conenction, certificate verification will be enforced, unless the option is reset explicitly

            Lawrin Lawrin Novitsky added a comment - If application is requesting encrypted conenction, certificate verification will be enforced, unless the option is reset explicitly
            opoplawski Orion Poplawski added a comment -

            But even when an application does not configure any SSL options, the default now is to require an SSL connection. This was very confusing for me to see the zabbix DB socket connection start to fail with `[2026] TLS/SSL error: SSL is required, but the server does not support it` when I hadn't actually configured SSL in the zabbix server configuration.

            See https://github.com/mariadb-corporation/mariadb-connector-c/blame/3.4/plugins/auth/my_auth.c#L294

            opoplawski Orion Poplawski added a comment - But even when an application does not configure any SSL options, the default now is to require an SSL connection. This was very confusing for me to see the zabbix DB socket connection start to fail with ` [2026] TLS/SSL error: SSL is required, but the server does not support it` when I hadn't actually configured SSL in the zabbix server configuration. See https://github.com/mariadb-corporation/mariadb-connector-c/blame/3.4/plugins/auth/my_auth.c#L294
            Lawrin Lawrin Novitsky added a comment -

            There is the issue in the setup dialog with this

            Lawrin Lawrin Novitsky added a comment - There is the issue in the setup dialog with this

            People

              Lawrin Lawrin Novitsky
              Lawrin Lawrin Novitsky
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.