4

I will preface by saying I can connect to the DB instance when I'm not trying to go over SSL.

I am following this guide here

http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Aurora.Connect.html

I have ensured the db instance is public facing.

The security group of the VPC has the following rules:

Type Protocol Port Range Source
MySQL/Aurora (3306) TCP (6) 3306 my_ip_address/32
MySQL/Aurora (3306) TCP (6) 3306 sg-security_group_name

Where the security_group_name is the security group for my EC2 cluster.

I am using the cluser endpoint of my aurora cluster. And I've removed the port. I installed mysql on my machine using homebrew. This is the command I am trying from my local machine (macbook):

mysql -h blah-database-cluster.cluster-dfgdgfd.us-east-1.rds.amazonaws.com --ssl-ca=rds-ssl-ca-cert.pem --ssl-verify-server-cert

Where rds-ssl-ca-cert.pem is the file I downloaded from here:

http://s3.amazonaws.com/rds-downloads/rds-ssl-ca-cert.pem

I get the error:

ERROR 2026 (HY000): SSL connection error: error:00000001:lib(0):func(0):reason(1)

I have tried creating a new instance, rebooting etc and no joy. Does my security group need some kind of https rule?

Edit:

Further clue. When I run mysql --ssl locally it doesn't error. But when I do mysql show_variables, it says SSL false and the have_ssl and have_open_ssl variables don't exist. Could this be the problem? I installed the local mysql via homebrew package manager for mac.

New edit:

I re-installed mysql (previously from brew) and now direct from oracle and when I try to connect it gives a different error - SSL connection error: ASN: bad other signature confirmation

4

4 回答 4

7

  1. 目前，AWS Aurora 文档链接到要使用的过期 SSL 证书，因此存在问题。AWS 支持人员已确认这一点。改用这个：https ://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem

  2. 即使使用该证书，通过 SSL 连接到集群端点对于使用 mysql -h 连接的命令行仍然不起作用。如果我奇怪地从集群端点更改为实例端点，它会起作用。

  3. 奇怪的是，mysql 工作台确实通过 ssl 连接到实例端点和集群端点。

于 2015-08-16T21:16:04.760 回答
1

如果您不使用 SSL，请使用带有 --skip-ssl 选项的 mysql。如果没有任何帮助升级您的 mysql 客户端

于 2016-12-13T12:02:57.540 回答
0

从文档看来，对 SSL 连接的实例端点的限制是与证书关联的安全约束。

当 Amazon RDS 预置实例时，Amazon RDS 会创建 SSL 证书并将证书安装在数据库实例上。这些证书由证书颁发机构签署。SSL 证书包含数据库实例终端节点作为 SSL 证书的公用名 (CN)，以防止欺骗攻击。因此，您无法使用数据库集群终端节点通过 SSL 连接到数据库集群的主实例。

于 2015-12-07T03:43:46.080 回答
0

仅供参考，请尝试使用此密钥（来自亚马逊文档）

https://s3.amazonaws.com/rds-downloads/rds-ca-2015-root.pem

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html

于 2018-07-18T19:25:37.647 回答