Solved MariaDB 5.5.43 and OpenSSL 1.0.1l-freebsd

[Ben]

Hi,

I recently upgraded my MariaDB 5.5.41 server to 5.5.43. Since then I can not connect via SSL anymore. Besides the upgrade nothing has changed.

When I try to connect via the MySQL client (MariaDB Client actually) I get the following error:

ERROR 2026 (HY000): SSL connection error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

Any idea what could have happened to cause this error? Before it worked.

I thought maybe it's related to the CA file and merged the client and server certificate into the CA-file. Then I get the error:

ERROR 2026 (HY000): SSL connection error: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small

I read something about a bug related to OpenSSL 1.0.1e and MySQL, but couldn't find out if this is related to the OpenSSL version of FreeBSD and MariaDB 5.5.43.

Can anybody help on this or has faced a similar issue recently?

Thanks for your help.

 

[junovitch@]

Have you also run a freebsd-update(8) lately? The cause is the result of bumping the OpenSSL DH parameter in the latest OpenSSL update to deal with the "Logjam" [CVE-2015-4000] vulnerability.

See: https://www.freebsd.org/security/advisories/FreeBSD-SA-15:10.openssl.asc

...
A man-in-the-middle attacker may be able to downgrade vulnerable TLS connections using ephemeral Diffie-Hellman key exchange to 512-bit export-grade cryptography. [CVE-2015-4000]. On FreeBSD 10.1, the patch contains a countermeasure for clients by rejecting handshakes with DH parameters shorter than 768 bits.
...

I haven't run into this on FreeBSD yet based on my current configuration but the fix for some CentOS systems at work with the issue was adjusting the cipher to CAMELLIA128-SHA. I don't remember the exact configuration lines to use but a quick search for it pointed out two websites that will get you pointed in the right direction.

http://www.couyon.net/blog/if-all-of-your-mysql-ssl-clients-just-broke
http://stackoverflow.com/questions/31424518/php-5-6-mysql-ssl-and-self-signed-certificates

 

[Ben]

Thanks so much for your help! I did indeed update the whole system but thought that the current OpenSSL version had been in place before.

I set

--ssl-cipher=AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA

in my my.cnf and it worked again.

Thanks so much!!