ERROR 2026 (HY000)

MySQL 8.0.42

SYMPTOMS

TLS/SSL error: self-signed certificate in certificate chain.

$ mysql -h192.168.3.68 -P33060 -uroot -p
Enter password:
ERROR 2026 (HY000): TLS/SSL error: self-signed certificate in certificate chain

CAUSE

mysql> SHOW VARIABLES LIKE '%ssl%';
+-------------------------------------+-----------------+
| Variable_name                       | Value           |
+-------------------------------------+-----------------+
| admin_ssl_ca                        |                 |
| admin_ssl_capath                    |                 |
| admin_ssl_cert                      |                 |
| admin_ssl_cipher                    |                 |
| admin_ssl_crl                       |                 |
| admin_ssl_crlpath                   |                 |
| admin_ssl_key                       |                 |
| have_openssl                        | YES             |
| have_ssl                            | YES             |
| mysqlx_ssl_ca                       |                 |
| mysqlx_ssl_capath                   |                 |
| mysqlx_ssl_cert                     |                 |
| mysqlx_ssl_cipher                   |                 |
| mysqlx_ssl_crl                      |                 |
| mysqlx_ssl_crlpath                  |                 |
| mysqlx_ssl_key                      |                 |
| performance_schema_show_processlist | OFF             |
| ssl_ca                              | ca.pem          |
| ssl_capath                          |                 |
| ssl_cert                            | server-cert.pem |
| ssl_cipher                          |                 |
| ssl_crl                             |                 |
| ssl_crlpath                         |                 |
| ssl_fips_mode                       | OFF             |
| ssl_key                             | server-key.pem  |
| ssl_session_cache_mode              | ON              |
| ssl_session_cache_timeout           | 300             |
+-------------------------------------+-----------------+
27 rows in set (0.03 sec)

mysql> SHOW STATUS LIKE 'Ssl_server_not%';
+-----------------------+--------------------------+
| Variable_name         | Value                    |
+-----------------------+--------------------------+
| Ssl_server_not_after  | Feb  1 04:26:44 2033 GMT |
| Ssl_server_not_before | Feb  4 04:26:44 2023 GMT |
+-----------------------+--------------------------+
2 rows in set (0.58 sec)

mysql> show variables like '%datadir%';
+---------------+-----------------+
| Variable_name | Value           |
+---------------+-----------------+
| datadir       | /var/lib/mysql/ |
+---------------+-----------------+
1 row in set (0.01 sec)

bash-5.1# openssl x509 -in "/var/lib/mysql/ca.pem" -noout -text | grep -A2 "Validity"
        Validity
            Not Before: Feb  4 04:26:42 2023 GMT
            Not After : Feb  1 04:26:42 2033 GMT

bash-5.1# openssl x509 -in "/var/lib/mysql/server-cert.pem" -noout -text | grep -A2 "Validity"
        Validity
            Not Before: Feb  4 04:26:44 2023 GMT
            Not After : Feb  1 04:26:44 2033 GMT

bash-5.1# openssl x509 -in "/var/lib/mysql/client-cert.pem" -noout -text | grep -A2 "Validity"
        Validity
            Not Before: Feb  4 04:26:44 2023 GMT
            Not After : Feb  1 04:26:44 2033 GMT

The Server CA is normal. so client key may be invaild.

SOLUTION

Use --skip-ssl option to disable ssl connection.

$ mysql -V
mysql from 11.8.1-MariaDB, client 15.2 for debian-linux-gnu (x86_64) using  EditLine wrapper

$ mysql -h192.168.3.68 -P33060 -uroot -p --skip-ssl
Enter password:
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MySQL connection id is 24
Server version: 8.0.42 MySQL Community Server - GPL

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Support MariaDB developers by giving a star at https://github.com/MariaDB/server
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MySQL [(none)]>

Create client cert.

$ mkdir ssl
$ openssl req -newkey rsa:2048 -days 365 -nodes -keyout ssl/user-key.pem -out ssl/user-req.pem
$ sudo openssl x509 -req -in ssl/user-req.pem -days 365 -CA /tmp/ca.pem \
   -CAkey /tmp/ca-key.pem -set_serial 01 -out ssl/user-cert.pem

Copy the ca-key.pem and ca.pem file from server.

$ openssl verify -CAfile /mnt/d/Container/mysql/wiki/data/ca.pem /mnt/d/Container/mysql/wiki/data/server-cert.pem ssl/user-cert.pem
/mnt/d/Container/mysql/wiki/data/server-cert.pem: OK
ssl/user-cert.pem: OK