Skip to content

Update server_auth.md with updates on resolved intermediate certificate issues #114

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
apalacheno wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update server_auth.md with updates on resolved intermediate certificate issues #114

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/mysql/topics/server_auth.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,4 +25,4 @@ Restart your MySQL server for these changes to take effect.

For additional security, step certificates are signed by an intermediate CA by default rather than the root CA. The intermediate certificate is bundled into your `{{ server_cert }}` file.

Unfortunately, MySQL has an [outstanding bug](https://bugs.mysql.com/bug.php?id=54158) that prevents it from being able to read the intermediate certificate out of `{{ server_cert }}`. So, when opening a connection from a MySQL client, we'll have to instead bundle that intermediate CA certificate together with the root CA certificate we saved previously (`{{ ca_cert }}`) and pass it into our client so that MySQL can read it and verify the server certificate that was signed by your CA's intermediate. This is covered in the Hello mTLS MySQL client docs.
MySQL had an [outstanding bug](https://bugs.mysql.com/bug.php?id=54158) (fixed in MySQL Server 8.0.30) that prevented it from being able to read the intermediate certificate out of `{{ server_cert }}`. So, if you are affected by this bug, when opening a connection from a MySQL client, you'd have to instead bundle that intermediate CA certificate together with the root CA certificate we saved previously (`{{ ca_cert }}`) and pass it into your client so that MySQL can read it and verify the server certificate that was signed by your CA's intermediate. This is covered in the Hello mTLS MySQL client docs.