|
Connecting with certificates that have the wrong extended key usage attributes (serverAuth instead of clientAuth) produces no error message on the client or the database.
[markusjm@monolith ssl-certs]$ mysql -u maxuser -pmaxpwd -h 127.0.0.1 -D test --ssl --ssl-key=client-key.pem --ssl-cert=client-cert.pem --ssl-ca=ca.pem -P 3000 -e "select 1"
|
+---+
|
| 1 |
|
+---+
|
| 1 |
|
+---+
|
[markusjm@monolith ssl-certs]$ mysql -u maxuser -pmaxpwd -h 127.0.0.1 -D test --ssl --ssl-key=server-key.pem --ssl-cert=server-cert.pem --ssl-ca=ca.pem -P 3000 -e "select 1"
|
ERROR 2013 (HY000): Lost connection to server at 'reading authorization packet', system error: 0
|
The only thing that the server logs is this:
2022-03-03 7:21:59 8 [Warning] Aborted connection 8 to db: 'unconnected' user: 'unauthenticated' host: '127.0.0.1' (This connection closed normally without authentication)
|
However, if I use the wrong certificate on the server, I get the following error message regardless of the type:
[markusjm@monolith ssl-certs]$ mysql -u maxuser -pmaxpwd -h 127.0.0.1 -D test --ssl --ssl-key=client-key.pem --ssl-cert=client-cert.pem --ssl-ca=ca.pem -P 3000 -e "select 1"
|
ERROR 2026 (HY000): SSL connection error: unsupported certificate purpose
|
[markusjm@monolith ssl-certs]$ mysql -u maxuser -pmaxpwd -h 127.0.0.1 -D test --ssl --ssl-key=server-key.pem --ssl-cert=server-cert.pem --ssl-ca=ca.pem -P 3000 -e "select 1"
|
ERROR 2026 (HY000): SSL connection error: unsupported certificate purpose
|
The client-cert.pem certificate has:
X509v3 extensions:
|
X509v3 Basic Constraints:
|
CA:FALSE
|
Netscape Cert Type:
|
SSL Client, S/MIME
|
Netscape Comment:
|
OpenSSL Generated Client Certificate
|
X509v3 Subject Key Identifier:
|
5D:97:20:0B:30:A6:96:FD:89:C8:AB:92:57:9B:7B:B5:89:06:A8:D0
|
X509v3 Authority Key Identifier:
|
DirName:/C=FI/L=Default City/O=Default Company Ltd/CN=localhost
|
serial:56:EA:28:16:63:2F:A1:F9:E3:1F:83:23:13:96:19:44:8B:E1:A9:88
|
|
X509v3 Key Usage: critical
|
Digital Signature, Non Repudiation, Key Encipherment
|
X509v3 Extended Key Usage:
|
TLS Web Client Authentication, E-mail Protection
|
X509v3 Subject Alternative Name:
|
DNS:localhost
|
The server-cert.pem certificate has:
X509v3 extensions:
|
X509v3 Basic Constraints:
|
CA:FALSE
|
Netscape Cert Type:
|
SSL Server
|
Netscape Comment:
|
OpenSSL Generated Server Certificate
|
X509v3 Subject Key Identifier:
|
48:CB:85:39:83:05:43:34:8D:D4:78:0B:20:4B:2B:0E:B8:71:E0:4A
|
X509v3 Authority Key Identifier:
|
DirName:/C=FI/L=Default City/O=Default Company Ltd/CN=localhost
|
serial:56:EA:28:16:63:2F:A1:F9:E3:1F:83:23:13:96:19:44:8B:E1:A9:88
|
|
X509v3 Key Usage: critical
|
Digital Signature, Key Encipherment
|
X509v3 Extended Key Usage:
|
TLS Web Server Authentication
|
X509v3 Subject Alternative Name:
|
DNS:localhost
|
The certificate MariaDB is configured with has:
X509v3 extensions:
|
X509v3 Basic Constraints:
|
CA:FALSE
|
Netscape Cert Type:
|
SSL Server
|
Netscape Comment:
|
OpenSSL Generated Server Certificate
|
X509v3 Subject Key Identifier:
|
FC:7F:37:42:8F:10:AC:E1:7D:15:8F:16:93:AF:7B:83:81:9B:60:C1
|
X509v3 Authority Key Identifier:
|
DirName:/C=FI/L=Default City/O=Default Company Ltd/CN=localhost
|
serial:56:EA:28:16:63:2F:A1:F9:E3:1F:83:23:13:96:19:44:8B:E1:A9:88
|
|
X509v3 Key Usage: critical
|
Digital Signature, Key Encipherment
|
X509v3 Extended Key Usage:
|
TLS Web Server Authentication
|
X509v3 Subject Alternative Name:
|
DNS:localhost
|
Grants for the user:
MariaDB [test]> show grants;
|
+-------------------------------------------------------------------------------------------------------------------------------------------+
|
| Grants for maxuser@127.0.0.1 |
|
+-------------------------------------------------------------------------------------------------------------------------------------------+
|
| GRANT ALL PRIVILEGES ON *.* TO `maxuser`@`127.0.0.1` IDENTIFIED BY PASSWORD '*5EDBD32E469DAE0CE10E6999C3899DEFCB9F12E0' WITH GRANT OPTION |
|
+-------------------------------------------------------------------------------------------------------------------------------------------+
|
1 row in set (0.000 sec)
|
|
ca-key.pem