[SOLVED] Strange issue with MariaDB connection

Rocky Linux Help & Support
1

Hello,

Sorry for my English I’m French.

I’ve a strange issue when I want to connect to my MariaDB Server with SSL. I explain.

I installed Rocky 10 on one of my Raspberry (Pi4), the other have Debian installed (I’m trying to migrate all to Rocky). This server is DNS and proxy server.

DNS seems to work good as all of my other servers can make nslookup and reverse nslookup without issue.

On 3 of these servers I installed a Kubernetes cluster which work like a charm. And on this cluster I run a mariaDB pod (using self-signed certificates) accessible using a service and a ConfigMap (specific DB port).

All my severs (Raspberry, NAS) can make a MariaDB connection (using mariadb -u user -p password -h host -P port) without issue. So I configured my Rocky Raspberry like the other but “modified” for Rocky (/etc/my.cnf, /home/user/.my.cnf) and copied the same mariaDB certificates (server ca, client cert and key) on the same location.

But when I try to connect on my MariaDB Server I receive this error:

ERROR 2026 (HY000): TLS/SSL error: Hostname verification failed

I tried a nslookup, it’s OK. I tried a telnet on the DB port, it’s OK.

I tried to find a resolution using google but I found nothing.:roll_eyes:

If someone have an idea :thinking:

2

Can you provide more information about “-h host” is that a FQDN? an IP address?

Google Gemini tells me that with "ERROR 2026 (HY000)” the hostname it expected to find in the server’s security certificate did not match the actual hostname in the certificate?

Tony

3

“-h host” is “-h FQDN”.

4

The mariadb has a server certificate, does it not?
Does the certificate have the FQDN as “Subject Name” or in “Subject Alt Names”?

5

After a lot of tests it’s OK now.

The reason is that Rocky is more strict than Debian using SSL connexion. If I try MariaDB connexion using “–ssl-verify-server-cert=0” it works.

So I needed to modify DNS resolution by adding a CNAME from Kubernetes service name to host and it works.

6

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.