Wiki

User Tools

Site Tools

Trace:
mysql:troubleshoot_mysql_ssl_replication_problems

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision		Previous revision
mysql:troubleshoot_mysql_ssl_replication_problems [2016/11/21 10:27] – created petermysql:troubleshoot_mysql_ssl_replication_problems [2020/07/15 09:30] (current) – external edit 127.0.0.1
Line 4: Line 4:
  
   * ERROR 2026 (HY000): SSL connection error: protocol version mismatch   * ERROR 2026 (HY000): SSL connection error: protocol version mismatch
-  * ERROR 2026 (HY000): SSL connection error: ASN: bad other signature confirmation// // Mismatch is usually because you're trying to authentication with your client certificates.  Using the **–ssl-ca** flag is sufficient.// +  * ERROR 2026 (HY000): SSL connection error: ASN: bad other signature confirmation 
 + 
 +Mismatches usually because you're trying to authentication with your client certificates.  Using the **–ssl-ca** flag is sufficient.  
 <code bash> <code bash>
 mysql -utransmed_app -p --ssl-ca=/etc/mysql-ssl/chain-cert.cer -h dest.example.com mysql -utransmed_app -p --ssl-ca=/etc/mysql-ssl/chain-cert.cer -h dest.example.com
 </code> </code>
-// + 
 +<WRAP notice>
 You MUST use a chain cert. You MUST use a chain cert.
 +</WRAP>
  
   * ERROR 2003 (HY000): Can’t connect to MySQL server on 'example.com' (111)   * ERROR 2003 (HY000): Can’t connect to MySQL server on 'example.com' (111)
- 
  
 Some MySQL selections don't support the PKCS#8 format. Some MySQL selections don't support the PKCS#8 format.
  
-1+<code>
 -----BEGIN PRIVATE KEY----- -----BEGIN PRIVATE KEY-----
-This occurs when keys are generated with OpenSSL 1.0+. To fix this issue you simply convert the key to PKCS#1 format:+</code>
  
-1+This occurs when keys are generated with OpenSSL 1.0+.  To fix this issue simply convert the key to PKCS#1 format: 
 + 
 +<code bash>
 openssl rsa -in pkcs8-key.pem -out pkcs1-key.pem openssl rsa -in pkcs8-key.pem -out pkcs1-key.pem
 +</code>
 +
 You should now see: You should now see:
  
-1+<code>
 -----BEGIN RSA PRIVATE KEY----- -----BEGIN RSA PRIVATE KEY-----
-Keep in mind you can’t just simply insert “RSA” into the PKCS#8 format. It won’t work! They’re different formats altogether. You can verify the certs/keys:+</code>
  
-1+Keep in mind you can't just simply insert “RSA” into the PKCS#8 format.  It won’t work!  They’re different formats altogether.  You can verify the certs/keys: 
 + 
 +<code bash>
 openssl verify -CAfile ca-cert.pem server-cert.pem client-cert.pem openssl verify -CAfile ca-cert.pem server-cert.pem client-cert.pem
-Additional troubleshooting tips: +</code> 
-Make sure both servers have SSL enabled. Make sure the master_ssl_ca has the entire CA chain or it won’t work!+ 
 + 
 +===== Additional troubleshooting tips ===== 
 + 
 +Make sure both servers have SSL enabled.  Make sure the master_ssl_ca has the entire CA chain or it won't work!
  
-1 +<file bash /etc/my.cnf>
-2 +
-3 +
-4 +
-# /etc/my.cnf+
 ssl-ca                 = /etc/mysql-ssl/chain-cert.pem ssl-ca                 = /etc/mysql-ssl/chain-cert.pem
 ssl-cert               = /etc/mysql-ssl/STAR_example_net.pem ssl-cert               = /etc/mysql-ssl/STAR_example_net.pem
 ssl-key                = /etc/mysql-ssl/wildcard-cert.pem ssl-key                = /etc/mysql-ssl/wildcard-cert.pem
 +</file>
  
  
-1 +<code mysql>
-2 +
-3 +
-4 +
-5 +
-6 +
-7 +
-8 +
-9 +
-10 +
-11 +
-12 +
-13 +
-14+
 mysql> show variables like "%ssl%"; mysql> show variables like "%ssl%";
 +---------------+-------------------------------------------------------+ +---------------+-------------------------------------------------------+
Line 63: Line 61:
 | have_openssl  | YES                                                   | | have_openssl  | YES                                                   |
 | have_ssl      | YES                                                   | | have_ssl      | YES                                                   |
-| ssl_ca        | /etc/mysql-ssl/COMODO-chained.pem |+| ssl_ca        | /etc/mysql-ssl/COMODO-chained.pem                     |
 | ssl_capath    |                                                       | | ssl_capath    |                                                       |
-| ssl_cert      | /etc/mysql-ssl/STAR_example_net.pem                  |+| ssl_cert      | /etc/mysql-ssl/STAR_example_net.pem                   |
 | ssl_cipher    |                                                       | | ssl_cipher    |                                                       |
 | ssl_crl       |                                                       | | ssl_crl       |                                                       |
 | ssl_crlpath   |                                                       | | ssl_crlpath   |                                                       |
-| ssl_key       | /etc/mysql-ssl/wildcard-cert.pem                  |+| ssl_key       | /etc/mysql-ssl/wildcard-cert.pem                      |
 +---------------+-------------------------------------------------------+ +---------------+-------------------------------------------------------+
 +</code>
 +
 If you run into this error: “Slave failed to initialize relay log info structure from the repository” you just need to run “RESET SLAVE;” If you run into this error: “Slave failed to initialize relay log info structure from the repository” you just need to run “RESET SLAVE;”
 +
 Make sure your firewalls have Port 3306 (or whatever port you’re using) open. Make sure your firewalls have Port 3306 (or whatever port you’re using) open.
 +
 Make sure secure_auth is on: Make sure secure_auth is on:
  
-1 +<code mysql>
-2 +
-3 +
-4 +
-5 +
-6+
 show variables like "secure_auth"; show variables like "secure_auth";
 +---------------+-------+ +---------------+-------+
Line 87: Line 84:
 | secure_auth   | ON    | | secure_auth   | ON    |
 +---------------+-------+ +---------------+-------+
 +</code>
 +
 Make sure you’re granting the correct permissions: Make sure you’re granting the correct permissions:
  
-1+<code mysql>
 GRANT REPLICATION SLAVE ON *.* TO slave_user@slave.example.net IDENTIFIED BY 'SecretPassw0rd' REQIURE SSL; GRANT REPLICATION SLAVE ON *.* TO slave_user@slave.example.net IDENTIFIED BY 'SecretPassw0rd' REQIURE SSL;
 +</code>
 +
 You should have master_ssl set to 1: You should have master_ssl set to 1:
  
-1 +<code mysql> 
-2 +change master to 
-3 +
-4 +
-5 +
-6 +
-7 +
-8 +
-9 +
-10 +
- change master to +
  master_host='master.example.com',   master_host='master.example.com', 
  master_user='slave=user',  master_user='slave=user',
Line 113: Line 105:
  master_ssl_cert='/etc/mysql-ssl/STAR_example_net.pem',  master_ssl_cert='/etc/mysql-ssl/STAR_example_net.pem',
  master_ssl_key='/etc/mysql-ssl/wildcard-cert.pem'  master_ssl_key='/etc/mysql-ssl/wildcard-cert.pem'
 +</code>
 +
mysql/troubleshoot_mysql_ssl_replication_problems.1479724034.txt.gz · Last modified: 2020/07/15 09:30 (external edit)
Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki