MySQL - SSL is required but the server doesn't support it

Question

I'm trying to enable SSL in MySQL. I ran the SSL Wizard on MySQL Workbench which generated these files:

• ca-cert.pem
• ca-key.pem
• client-cert.pem
• client-key.pem
• server-cert.pem
• server-key.pem

Then I changed my.cnf file like this:

[client]
ssl-ca=<directory>/ca-cert.pem
ssl-cert=<directory>/client-cert.pem
ssl-key=<directory>/client-key.pem

[mysqld]
ssl-ca=<directory>/ca-cert.pem
ssl-cert=<directory>/server-cert.pem
ssl-key=<directory>/server-key.pem

where <directory> is the directory where these files are located.

Then I set the configuration file path in MySQL Workbench and restarted mysql service but when I test the connection it gives me this error:

ERROR 2026 (HY000): SSL connection error: SSL is required but the server doesn't support it

How can I solve this?

Solution

I had a similar problem and it was solved by changing the certificate files permission.

sudo chmod 444 ca-cert.pem;
sudo chmod 444 client-cert.pem;
sudo chmod 400 client-key.pem;

sudo chmod 444 ca-cert.pem;
sudo chmod 444 server-cert.pem;
sudo chmod 400 server-key.pem;

sudo chown mysql:mysql ca-cert.pem;
sudo chown mysql:mysql client-cert.pem;
sudo chown mysql:mysql client-key.pem;

sudo chown mysql:mysql ca-cert.pem;
sudo chown mysql:mysql server-cert.pem;
sudo chown mysql:mysql server-key.pem;

Restart the server...

Comments

[Dave S]

What OS is the MySQL service running on?

[dems98]

@DaveS Ubuntu 18.04.3 LTS

[Alfabravo]

WOrkbench sits in the same machine as MYSQL server?

[dems98]

@Alfabravo Yes it's all in localhost

[Alfabravo]

Restarted the mysql-server service after changing configuration?

[dems98]

@Alfabravo Yes, I wrote it in the question

[Max Raskolnikov]

Can I connect without SSL? HeidiSQL is able to make it, but MySQL WB couldn't :(

[dems98]

I've changed these lines but it always gives me the error

[Prabhjot Singh Kainth]

can you post <directory>?

[dems98]

I've followed this link dev.mysql.com/doc/workbench/en/…

[Alfabravo]

@Demetrio Odd because the suggestion done in the answer is actually in the document you link to and the conf data you provided did not. Did you see the message stated in step 6?

[dems98]

@Alfabravo No it didn't appear

[Alfabravo]

Then it is not properly configured.

[dems98]

I've changed the ownership and permissions of .pem files and moved the client .pem files in a directory and the server .pem in another; it works but only if I use the mysql client with sudo, maybe because the client files are owned by mysql user. Is there a way to connect without sudo?

[Jonathan Martins]

I do connect without sudo, I think this is possible because the certificate files are owned by mysql user.

[S.M.Mousavi]

final sentence is important "Restart the server..."