https://github.com/osquery/osquery logo
Join Slack
Powered by
I just setup an SSL connection for my MYSQL connec...
# fleet
r
I just setup an SSL connection for my MYSQL connection and am getting this error 
{"mysql":"could not connect to db: x509: cannot validate certificate for 1.1.1.1 because it doesn't contain any IP SANs
I can connect fine to the MYSQL instance from the server running fleet by adding the --ssl-cert --ssl-key and --ssl-ca
Copy code
mysql:
  address: 1.1.1.1:3306
  database: fleetdm
  username: user
  password: ':)'
  tls_ca: /etc/ssl/certs/server-ca.pem
  tls_cert: /etc/ssl/certs/mysql-fleet-cert.pem
  tls_key: /etc/ssl/certs/mysql-fleet-key.pem
  server_name: 1.1.1.1
What am I missing?
k
Have you tried the hostname instead of IP? That error sounds like the certificate is issued for the hostname.
k
I think @Keith Swagler is on the right track here, It sounds like you have your certificate set up with a hostname and the IP address isn't included as an SAN (Subject Alternative Name)
r
🤔 I've tried with the server name and registered hostname also and can connect using the mysql client on the same system
k
Is the error the exact same when using the hostname rather than the IP address for 
address
?
r
yes exact same
k
What version of MySQL are you running?
r
8.0
k
When you're connected to the MySQL server, does running the 
status
command show that SSL is actually in use?
Copy code
mysql> \s
k
You could also use openssl like 
openssl s_client -showcerts -connect 1.1.1.1:3306
r
@Kathy Satterlee
Copy code
SSL:	Cipher in use is ECDHE-RSA-AES128-GCM-SHA256
Can connect to the instance using the below, if I don't pass the -ssl parameters the connection fails
Copy code
mysql -u user -p -h 1.1.1.1 --ssl-ca=/etc/ssl/certs/server-ca.pem --ssl-cert=/etc/ssl/certs/mysql-fleet-cert.pem --ssl-key=/etc/ssl/certs/mysql-fleet-key.pem
k
Thanks. I have some suspicions about what may be going on, but I'd like to double-check a couple of things. Bear with me.
👀 1
Thanks for being patient there. There were some changes to SSL with MySQL 8 and I wanted to make sure I was familiar with the defaults. By default, MySQL doesn't much care about much except whether the cert is present. Try logging in to the MySQL server with ‘—ssl-mode=VERIFY_IDENTITY’ to more closely mirror the connection being made with Fleet
r
@Kathy Satterlee that reproduces the error where I can't login anymore 👍
13 Views
Open in Slack
PreviousNext
Powered by