[urbanecm@phab1005 ~]$ grep host .my.cnf host=m3-slave.eqiad.wmnet [urbanecm@phab1005 ~]$ mysql ERROR 2026 (HY000): TLS/SSL error: Certificate verification failure: The certificate is NOT trusted. [urbanecm@phab1005 ~]$
On phab1004 (now decommissioned), this used to work seamlessly. Why is phab1005 not trusting the cert on the CLI?
| Subject | Author | Repo | Branch | Lines +/- | |
|---|---|---|---|---|---|
| phabricator: add skip-ssl option to client config | AOkoth | operations/puppet | production | +1 -0 |
@Urbanecm We updated the phabricator hosts to a newer Debian version (with a newer mysql client) and from what I've gathered the newer versions default to requiring certificate verification.
You can try adding this to your .my.cnf.
[client] skip-ssl=true
cc: @Marostegui
You can try adding this to your .my.cnf.
That helps, but I can't really add it to .my.cnf (or at least not easily). That file is autocreated by puppet, see profile::phabricator::main, line 526.
Ooh. I had no idea the file is managed by Puppet.
I'll push a patch to change it though realistically might be merged tomorrow (reviews and all).
Change #1337657 had a related patch set uploaded (by AOkoth; author: AOkoth):
[operations/puppet@production] phabricator: add skip-ssl option to client config
Change #1337657 merged by AOkoth:
[operations/puppet@production] phabricator: add skip-ssl option to client config
Now it works:
[urbanecm@phab1005 ~]$ mysql Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 12593535 Server version: 10.11.16-MariaDB-log MariaDB Server Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. mysql:phstats@m3-slave.eqiad.wmnet [phabricator_maniphest]> ^DBye [urbanecm@phab1005 ~]$
Thanks all!
Curiosity question...why have we decided to skip certificate verification altogether? Wouldn't it make sense to make the cert trusted, so that if someone is in the middle of the connection, it doesn't get compromised? I'm sure there are valid reasons for this decision, but I don't really understand it.
@Arnoldokoth Do you know?
My assumption would be that since the connection between the phab host and db host happens on a trusted private network there is a low chance of compromise. I think a certificate would be recommended if the database host is on a public network.
Any thoughts? @Dzahn @Marostegui