0
661
ViewsMySQL ERROR 2026 - SSL connection error - Ubuntu 20.04
I've recently upgraded my local machine OS from Ubuntu 18.04 to 20.04, I'm running my MySQL-server on CentOS (AWS). Post upgrade whenever I'm trying to connect to MySQL server it is throwing SSL connection error.
$ mysql -u yamcha -h database.yourproject.com -p --port 3309
ERROR 2026 (HY000): SSL connection error: error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol
But if I pass --ssl-mode=disabled option along with it, I'm able to connect remotely.
$ mysql -u yamcha -h database.yourproject.com -p --port 3309 --ssl-mode=disabled
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 22158946
Server version: 5.7.26 MySQL Community Server (GPL)
Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql>
Queries:
- How to connect without passing
--ssl-mode=disabled- How to pass this
--ssl-mode=disabledoption in my Django application, currently I've defined it as shown below, but I'm still getting the same error.
DATABASES = {
'default': {
'ENGINE': 'django.db.backends.mysql',
'NAME': 'yamcha',
'USER': 'yamcha',
'PASSWORD': 'xxxxxxxxxxxxxxx',
'HOST': 'database.yourproject.com',
'PORT': '3309',
'OPTIONS': {'ssl': False},
}
6 answers
Answer question0
Ubuntu 20 has improved the security level. The only way i could connect whas allowing the tls 1 .
Edit this file:
/usr/lib/ssl/openssl.cnf
And put at the beginning of file:
openssl_conf = default_conf
And in the end of that file too:
[ default_conf ]
ssl_conf = ssl_sect
[ssl_sect]
system_default = ssl_default_sect
[ssl_default_sect]
MinProtocol = TLSv1
CipherString = DEFAULT:@SECLEVEL=1
It help me a lot: https://askubuntu.com/questions/1233186/ubuntu-20-04-how-to-set-lower-ssl-security-level
0
Add this to your mysql 5.7 server config file and then restart your mysql service
[mysqld]
tls_version=TLSv1.2
Now you should be able to connect to it using tls 1.2, which is the default in Ubuntu 20.04
For the sake of completeness, in Ubuntu 20.04 actually my.cnf and mysql.cnf are actually the same file. So editing either one will work.
$ readlink -f /etc/mysql/my.cnf
/etc/mysql/mysql.cnf
0
Bump mysqlclient to v2.X, which added ssl_mode option, https://github.com/PyMySQL/mysqlclient-python/blob/main/HISTORY.rst
DATABASES = {
'default': {
'ENGINE': 'django.db.backends.mysql',
'NAME': 'yamcha',
'USER': 'yamcha',
'PASSWORD': 'xxxxxxxxxxxxxxx',
'HOST': 'database.yourproject.com',
'PORT': '3309',
'OPTIONS': {'ssl_mode': 'DISABLED'},
}
}
0
For anyone googling, you can use this flag in mysql cmd: --ssl-mode=DISABLED. I.E:
mysql -uuser -p'myPassw0rd!' -hmysql.company.com --ssl-mode=DISABLED
0
If You are using MYSQL Workbench :
Just Disable the SSL by editing the connection.
Go to edit Connection in connection panel
Select SSL in options after parameter as given in screenshot On connection
- Select Use SSL : NO
- Finally it would look like this.
On clients other than Mysql workbench also you can try disabling SSL
0
If you still want the upgraded security features then you can consider upgrading your mysql server to 5.7.