[MDEV-26731] Suddenly, started getting "ERROR 2026 (HY000): Unknown SSL error" Created: 2021-09-30  Updated: 2021-10-26  Resolved: 2021-10-26

Status: Closed
Project: MariaDB Server
Component/s: SSL
Affects Version/s: None
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: Nuno Assignee: Sergei Golubchik
Resolution: Not a Bug Votes: 0
Labels: None


 Description   

MariaDB instance on CentOS 7 has been running well for ages, and suddenly, starting about 30 minutes ago, my apps get this error trying to connect:

    # mysql
    ERROR 2026 (HY000): Unknown SSL error

My certs have been always under "/etc/my.cnf.d/certs/", generated by LetsEncrypt.
They expire on 2021-11-04, last modified date 2021-08-06.

my.cnf:

    ssl_cert                        = "/etc/my.cnf.d/certs/fullchain.pem"
    ssl_key                         = "/etc/my.cnf.d/certs/privkey.pem"

Looking at the logs, there's nothing that hints anything.
The latest log there is about "InnoDB: Online DDL", long ago.

*How can I investigate the cause of this problem?*
From the research I made, the questions are due to setup issues, while in my case it's been working since always, but *"suddenly" failed, and I can't see what changed*.

UPDATE I wonder if this related,

https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/

https://community.letsencrypt.org/t/help-thread-for-dst-root-ca-x3-expiration-september-2021/149190

> On September 30 2021, there will be a small change in how older browsers and devices trust Let’s Encrypt certificates.
> (...)
> DST Root CA X3 will expire on September 30, 2021.

I wonder how can I make MariaDB trust ISRG Root X1!



 Comments   
Comment by Nuno [ 2021-09-30 ]

Alright... for those who have the same problem,

Run this if you haven't yet:

`# yum update ca-certificates`

If you get `No packages marked for update`, it may have been already run automatically - in my case, it was on Sep 24:
`Sep 24 05:00:16 Updated: ca-certificates-2021.2.50-72.el7_9.noarch`

And then run in your MySQL instance:

`> FLUSH SSL;`

This resolved my problem!

Generated at Thu Feb 08 09:47:31 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.