2

We just had a migration from a "unsecured" mysql DB to a SSL mysql but my Django application cannot connect anymore.

content of settings.py

DATABASES = {
    "default": {
        "ENGINE": 'django.db.backends.mysql'
        "NAME": env("DATABASE_NAME"),
        "USER": env("DATABASE_USER"),
        "PASSWORD": env("DATABASE_PASSWORD"),
        "HOST": env("DATABASE_HOST"),
        "PORT": env.int("DATABASE_PORT"),
        "CONN_MAX_AGE": env.int("DATABASE_CONN_MAX_AGE", default=0),
    },
    "OPTIONS": {
        "timeout": env.int("DATABASE_CONN_TIMEOUT", default=60),
        "ssl": {
            "ca": CA_ROOT_PATH
        },
    }
}

and when I execute this Django command line : python3 manage.py dbshell (which used to work with the pre-migration DB), I receive the error message :

ERROR 2026 (HY000): SSL connection error: unknown error number
subprocess.CalledProcessError: Command '['mysql', '--user=user', '--password=password', '--host=host', '--port=3306', 'db']' returned non-zero exit status 1.

As you can see, the executed mysql command does not contain anything related to SSL connection.

I tried also to modify the OPTIONS in settings.py with these values :

    "OPTIONS": {
        "timeout": env.int("DATABASE_CONN_TIMEOUT", default=60),
        "ssl": {
            "ssl-ca": CA_ROOT_PATH,
            "ca": CA_ROOT_PATH
        },
        "ssl-ca" : CA_ROOT_PATH,
    }

Still the same output. It does not seem to use the SSL options in any way... Any idea what I should look for ?

Steven
  • 14,048
  • 6
  • 38
  • 73
  • Possible duplicate of https://stackoverflow.com/q/4323737/20860 – Bill Karwin Dec 03 '21 at 16:01
  • @BillKarwin As you can see, I already tried this solution. The probleme is not the option, it is the fact that this option does not reflect in the command. – Steven Dec 03 '21 at 16:05

1 Answers1

0

Your "OPTIONS" should probably be inside the "default" connection, now you have two connections "default" and "OPTIONS" instead of having the "OPTIONS" set under the "default" connection. See how it's done in the possible duplicate Bill linked.

Tuure
  • 16