Can't connect with SSL

Can't connect with SSL

Postby mdraca » Mon 26 Sep 2011 12:14

Hi.
I'm using Devart dotConnect for MySql version 6.30.165.0 and i have trouble connecting with SSL.
If I use CaCert, Cert and Key properties of MySqlConnection.SslOptions MySql responds with
Code: Select all
SSL connection error (2026):
Verification check of remote certificate failed.

if I skip CaCert and use only Cert and Key, connection is successful.

This is a code snippet that doesn't work
Code: Select all
static void Main(string[] args)
      {
         var myConn = new MySqlConnection("host=localhost;protocol=SSL;user=ssluser;password=localusrpass;database=testssl");
         myConn.SslOptions.CACert = "file://c:\certs\CA-cert.pem";
         myConn.SslOptions.Cert = "file://c:\Certs\client-cert.pem";
         myConn.SslOptions.Key = "file://c:\Certs\client-key.pem";
         var myCommand = new MySqlCommand("select count(*) from tbl1", myConn);
         try
         {
            myConn.Open();
            Int64 count = Convert.ToInt64(myCommand.ExecuteScalar());
            Console.WriteLine(count);
            myConn.Close();
         }
         catch (Exception ex)
         {
            Console.WriteLine(ex.Message);
         }
         Console.ReadLine();
      }

and this works
Code: Select all
static void Main(string[] args)
      {
         var myConn = new MySqlConnection("host=localhost;protocol=SSL;user=ssluser;password=localusrpass;database=testssl");
         //myConn.SslOptions.CACert = "file://c:\certs\CA-cert.pem";
         myConn.SslOptions.Cert = "file://c:\Certs\client-cert.pem";
         myConn.SslOptions.Key = "file://c:\Certs\client-key.pem";
         var myCommand = new MySqlCommand("select count(*) from tbl1", myConn);
         try
         {
            myConn.Open();
            Int64 count = Convert.ToInt64(myCommand.ExecuteScalar());
            Console.WriteLine(count);
            myConn.Close();
         }
         catch (Exception ex)
         {
            Console.WriteLine(ex.Message);
         }
         Console.ReadLine();
      }

What am I doing wrong?

Certificates are valid, using all of the three files works well when connecting directly to mysql from console.

Thanks.
mdraca
 
Posts: 2
Joined: Mon 26 Sep 2011 09:15

Postby Shalex » Fri 30 Sep 2011 10:35

If you are using CaCert, Cert, and Key properties, there is a double protection:
- server validates Cert and Key, which are set in the connection string, and returns its response (1);
- our provider validates server's Cert and Key basing on the CACert from the connection string (2).

If you skip CaCert and use only Cert and Key, there will be only the check (1).

mdraca wrote:
Code: Select all
SSL connection error (2026):
Verification check of remote certificate failed.

This means that the check (2) failed. As a workaround, please use only the check (1).
We cannot reproduce the problem with CaCert in our environment using our test certificates. If possible, send us the following information:
1) your test certificates. If you cannot give us your current certificates, please generate the test ones, with which the problem persists as well;
2) the version of your MySQL server;
3) the version, edition, capacity of operating system where you are running the program.
Shalex
Devart Team
 
Posts: 7290
Joined: Thu 14 Aug 2008 12:44

Postby mdraca » Mon 03 Oct 2011 20:15

MySql is as follows:
version: 5.5.11
version_comment: MySQL Community Server (GPL)
version_compile_machine: x86
version_compile_os: Win64

OS is Windows 7 Ultimate 64 bit (ver 6.1.7600).

Certs (no option to attach so...):
CA cert
Code: Select all
-----BEGIN CERTIFICATE-----
MIIDfTCCAmWgAwIBAgIJAKvFBdesjzXmMA0GCSqGSIb3DQEBBQUAMFUxCzAJBgNV
BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
aWRnaXRzIFB0eSBMdGQxDjAMBgNVBAMMBW1hcmtvMB4XDTExMDkyMDEwMzcxNloX
DTE0MDYxNjEwMzcxNlowVTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3Rh
dGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEOMAwGA1UEAwwF
bWFya28wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDG6YO2og8StPGL
zvfjXO7uO7vWADtJoUFL3o3Lfgv3oNXcVeVYoO8fzDtB/YkdA8teztMYLDm6Zgz1
txUXnvXnpCxT0c/PWXiUTblePA8psCymWyMINpNX1S3nspyUiLS6lSAzcUS0Oahz
oiBB1LKMtjxVKWTdp4u96CjBiCUpJNeGFILH4WqCMN9M6Kg/5SNrMdi7uz4n1Elv
dVK4T62UDIn6gGSwyjhPBKBaYwV/nWYJTaql3p7cp8jZzKB5ZIo97j+Ua5Wv8qVl
9V9PedFV3lP79K71+/NZ6AJ12mQgdt8eedggB2clhXRxyul4uu6cZVb3qM1P2aL4
slA+sOYvAgMBAAGjUDBOMB0GA1UdDgQWBBS4nnIljK/sxLwVobXBeSo2Mfz7GTAf
BgNVHSMEGDAWgBS4nnIljK/sxLwVobXBeSo2Mfz7GTAMBgNVHRMEBTADAQH/MA0G
CSqGSIb3DQEBBQUAA4IBAQByM7J1LHPlRhMHd7T/UDF+80xHkHJWzRmq9nkyK1Eb
0PyEth9GLXASoRuoqoBXoLrCBCCjTLK0b9U3g8p3/BzanJKtx4ayQ9EYW8ex2n3V
y+wkl4T5Du48pu72St4bKshrziByA0i2mMaQ+6W/ExOvK2AdWxAgUSpdEIlTt1gD
GcsHnNSC5fwuAHODi659XB0JzgFXLy96tqtJHKb6r8e2H3H98OYnu2WaFfFcsyOu
QXQzvrLIjFXu4DlGFXRrdF7eM/dPiLP4JEEkNnkIhvElDSQ8wvFwVh5V1ABA/hX5
cOZVqaGHfuEyvEuue+ELG8NdpgqLKxjYaw8P/EXHWhWR
-----END CERTIFICATE-----

client cert
Code: Select all
-----BEGIN CERTIFICATE-----
MIIDHjCCAgYCAQEwDQYJKoZIhvcNAQEFBQAwVTELMAkGA1UEBhMCQVUxEzARBgNV
BAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0
ZDEOMAwGA1UEAwwFbWFya28wHhcNMTEwOTIwMTAzOTQ3WhcNMTQwNjE2MTAzOTQ3
WjBVMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwY
SW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQ4wDAYDVQQDDAVtYXJrbzCCASIwDQYJ
KoZIhvcNAQEBBQADggEPADCCAQoCggEBAL0NWH55HU6DtQ+wBldPOJp2Ii8OY5o2
KLT/U5ZjNas4jZEhmkmmvjUuxx/q07IZN20koemDnx2NbCiFY8/+AtWQhQheaLJn
FALGV6Lu1qcuxl18JWW53dxvzII51BP2ug1Yhu55N18G18E+9DXdrWz9xNISLZki
W1Sm6/ZfXL/UIj/M1+OzfkdG/dSjssr5RwzQXCt63emNR3zG/euaxKfxB6dFOJop
V6iPYvT5B5LsrpU/ib4mIejMv/tAoLgbSuQ7zSyuClZYiAaXvPEQmnF34wHy1Pi6
ouC+eHW5Aep3V86g+haB5+2YxeMllzSzTAGu30IlT+u+XD3L9KSxOWsCAwEAATAN
BgkqhkiG9w0BAQUFAAOCAQEAW1C24OhkP7eMT7V9NmUj+J/+KlTcRtZRztZ6TbEM
I0WjVHdykC6u8dvbMwszQ09J/f5jVliLPmdoBbUwaXw6UZEUOvJ5thE7MDs0oKEn
j6wagY0TJxwYz/3SMZ+8PZQAz4x1nku9OjslMqGqJV1JuCArQJwx2Bbz0cF6Lp4+
wL3ilw8ldcJbtMscattoe79yoIuxDH0p/+AzBeWQYEvpL7jWvFY42zwkyAhRJNYu
tdHrLPy9TT5BH5+lRh3WcYSeGDjVenS6HQftdXeW2oU15zKhLacVGsR9MPs1tp3w
vJ73mPLNC5/6aQs8do4gO+3i4LxzTEevk/JAyLBF7MDxJg==
-----END CERTIFICATE-----

client key
Code: Select all
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAvQ1YfnkdToO1D7AGV084mnYiLw5jmjYotP9TlmM1qziNkSGa
Saa+NS7HH+rTshk3bSSh6YOfHY1sKIVjz/4C1ZCFCF5osmcUAsZXou7Wpy7GXXwl
Zbnd3G/MgjnUE/a6DViG7nk3XwbXwT70Nd2tbP3E0hItmSJbVKbr9l9cv9QiP8zX
47N+R0b91KOyyvlHDNBcK3rd6Y1HfMb965rEp/EHp0U4milXqI9i9PkHkuyulT+J
viYh6My/+0CguBtK5DvNLK4KVliIBpe88RCacXfjAfLU+Lqi4L54dbkB6ndXzqD6
FoHn7ZjF4yWXNLNMAa7fQiVP675cPcv0pLE5awIDAQABAoIBAHZFax90VclQzG1M
CiuE/Dxlu20E63sGduEE+x4SYvkDIE2zX/rDvis3YIuvNVEuRWaajFCyb1DlsMyI
5rCwkMVa7F8X8RfrNLGntBvSn6dns+G4UQ0bApltt9ugofT7XdoLkB6Q5vskJMZY
xB8O1/hfqkph5PTwcYK8CtLPRg8ba9vUPg2zlTfR8p0fZueGHqQVraDkmBJM3KR3
tz4Y9WhnwlaRnqh8Q/4VKdhB0QKRIrzxTxWpHnfT6/R/8RZ9BCyT/ukxC1Kjx3S5
v6dXKNZfdoKfyvadkOHiSScbIV2twu8KcHUol7eJCCGQ1cek+IOQnJS1IPrmBN4K
C5Q5HsECgYEA5vHKj/Fjh/9FM1zsoyBfw4RXCzOEKg/i8BCiTtmYgAIUVaN+mZXe
76wUNod+LlfWMZwtXiv+Lpncrn+iOVwVHzSWW4xdjMaDzW+fgyIyy65j3TCs0Pyx
REw4LWWpIzRZ/7cyh1DeINdWcLN/qYlVW1HRJ35GLi0hjO/QyduaAKUCgYEA0ZAL
NebpyybxypLGq7iBMvKxc2TX7TN/MLOyOPMJsGJYgd9JaSf8zdJ3By4ebk7OICzx
7TAzUEL8CHBnxa1bRVnhA40iKFJyT9c/1BnAL3ulZnXGAXJq7WTmuuUTw2INWxvL
KTJG8BiaJipye5PsM0TDfhaUhOXH0boVFOrtpM8CgYEAx1wmnoekgfvMwwAOjusd
f+w4L8Uy7BR2tQHG+wY/7RDeeOcAHJkRsBf+AuyH8n2Eu6K0Tzzu2U+c/03Svm1N
FnkQ6sqK30Fm+erH6i2VZ9qM/p5MMMRSSkD5pcbCcU95+ZMtnT4j4nnBdtyc8b9J
3eENCmipMKdo9P74X6igkrkCgYAgWbExV/09bDylPfVHawse11JHcwjWSD3ZQdRA
cFxNi1EIc3S8s/yVtWjEhf0SoD23v9h0+hzhxgVsNBYA8RsG4LIYvz/Ho7qb0qm6
z2LYsai94W54qLYTAaGQtm5PmiJfrzG0oVtMEzAwthrIMvSikXnwTAIPZf1rxeMd
QIsBBwKBgQCioJnLYGH+8OIqCvXqsvEvCR0rJymjti/MdZyualqjAf7Nrv+joP8a
yl6SqpjNFLuhJvIa/2OZNDGRkZCGLGOFZGvNH6BKgAFcgnbQffB+TCtz9yomMXjK
F9X08Zbzwc7XneyeciZBNe7hAjXE1JNLXGy/kbArUo4tx3g0A1kcAA==
-----END RSA PRIVATE KEY-----

server cert
Code: Select all
-----BEGIN CERTIFICATE-----
MIIDHjCCAgYCAQEwDQYJKoZIhvcNAQEFBQAwVTELMAkGA1UEBhMCQVUxEzARBgNV
BAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0
ZDEOMAwGA1UEAwwFbWFya28wHhcNMTEwOTIwMTAzODM0WhcNMTQwNjE2MTAzODM0
WjBVMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwY
SW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQ4wDAYDVQQDDAVtYXJrbzCCASIwDQYJ
KoZIhvcNAQEBBQADggEPADCCAQoCggEBAL1clXZ4p7nTRVCnfSt9ngJds09r+8J5
mqjuzW611Nw8MTvyhFL2pg5V1uOnGqnyBxuKpk8Kj0Ku+RWv9/tOPzbQGVR3D1eB
EUMK1Pj2KmVIBe8j1JJFNoWwWCubvN5zHLwkN18YGKXS8lHKIT19dUcJAPasNm2C
mjjBF5Djr4rddtNcNbp5Y73BkzRJ7vPqqd8pm6k0m/YBlUax6Qg2o9CDxcu8VZRD
k/g4AtrrVSwOoDUaNZI7jWT+2IA+cPgqrT9nB45i2z7Du0UuHzmqkwqMAXztS2X7
L7HsniNP2joKxorgnTVuAqwaWYdzi2B+YfUZKsjW7QXzVA/FUVIPnZ0CAwEAATAN
BgkqhkiG9w0BAQUFAAOCAQEAAxkT9JpEtqikbXIjghweZC9XsZdWXu1cLq4xoac9
G1mBZqTGFpH/0SHFSgVbEn5I8X3fKunuUJI1AwoL5POI6vjzE5tINfUeXr+DqPh+
9cQulRFlri5cUtIYfY9LniABvBDYCHDMAoMG0MNc+H6lPEXJ6pA9FniZKtUhcaml
J/ePjfQreRL5lk+X6IKu0ycZc6fZdhhQKBtyHPNmzuuRGYKsiGcZda40I2ZJOA2z
fovqYpcRK4/ti0dGLpmsCoYBpfQtLIDcwphIizZGGcCEsyxy0FKiLvXQJydP+6nn
tjhxyWiGiFKYc1Fq1RC/cZ0Xk8KH+QMMfKEIBuqtL3crbA==
-----END CERTIFICATE-----

server key
Code: Select all
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAvVyVdninudNFUKd9K32eAl2zT2v7wnmaqO7NbrXU3DwxO/KE
UvamDlXW46caqfIHG4qmTwqPQq75Fa/3+04/NtAZVHcPV4ERQwrU+PYqZUgF7yPU
kkU2hbBYK5u83nMcvCQ3XxgYpdLyUcohPX11RwkA9qw2bYKaOMEXkOOvit1201w1
unljvcGTNEnu8+qp3ymbqTSb9gGVRrHpCDaj0IPFy7xVlEOT+DgC2utVLA6gNRo1
kjuNZP7YgD5w+CqtP2cHjmLbPsO7RS4fOaqTCowBfO1LZfsvseyeI0/aOgrGiuCd
NW4CrBpZh3OLYH5h9RkqyNbtBfNUD8VRUg+dnQIDAQABAoIBAQCLbt37c1KFqUSz
4/BuErxDn71F8QxbofE5DUYljCxl0siqDKRU9ptFmP13efdPRhDnvctCDlN41aBB
0OX3nSE8+jR8loKsezQ7uoEhpRmIpGUCNs7yuZYxEK2LxsxmvDpfawd+tR6JE/As
O3sIbRXrLX0RJbOaJX3r5nq0zILY631RL6bcLlfwQgzKxBqjhiZrJ5SMjW+vWp6m
Dy2VX/2vxFvPTDtp+iYnc3ks8wdO4QKC702ZumiaVNN1k1Jc192pFKrtzK+eb3QU
VubxfMmNqV1Y1KSZpOEw6g1ELkXFx/dmHMG6LjXpcMweEmWcIaDMQR7Y/s7kumKX
7p3gvp/dAoGBAPh8ltMbNDsVUZ3WM4IzczC2WNaPl1Ydu77lUombomXk6fLiCzJX
oz5ChRbrXhHgbLsh1cE6dFSluNnDK80pXE+c0XCu/0yLbDADPZrWpawhd8KN2Yd1
GsG/nsnlMg5KqUSj7+Pa9HqKaMqYZ/IDmJRle9zYBDUGSllPRXrsd9BbAoGBAMMW
VmfmxNew4KacjGNtf6txeMoLJduLtd9J/qDuiUQBoG+iBwVLcKMyGJ/ZpufRVg8M
VFxxqo1UkVpLUgNNDpLvGzBLREWj8lmGY53f+mtTDlzU2YUxVDtOhgy9KUrrPTcn
vT2UQaC/kzzZ7dBG1qhj1VRLn8auDCy3p6mgaqtnAoGAdTwSzLbhBZ8hSp5s3tj3
V9wwPcqxU+fjVEVNk67iB8Dgv772GWJPmmg38oBJeZWwtvlXqDqz99vYQqVaXQlO
jCEoj0mBGdQNzvk4b30l3PhNUHUsVERjw1VszURdQXDoO4I9A/uhrM7wceVF5WDc
8+aNcbxY/8tf+JL17PDz9lECgYAchS56oB0U31HoaaiIfKCWgs9C0mBleUZMb3ff
NSAyJf67czeNiZrc8NzyuZIR/+OR7Z6DqUZixQM+7RX/T4ua5YPXCpnfiHlMpz32
/aCRgiHuZluqgiyrQu6L/DeGMV/QqWmcEAmMI5W15rJCqaiGE5pDaY7hL96txuem
/8G4bwKBgQC31EMHaYIXcxfoNm/ht4en5X3jUGw6quuyYwd4pYYC7fJHfMajhLml
efh0i+q98d9cyugTJ+qn7XTql1ov56F5emPqe8zn89g7+LDpdnocEermqMLcO/xI
pW3YTiL16qmb0c6axxhrz7pMFnkEe8ElGCnxhu4nBQn0VWiLLjXM1A==
-----END RSA PRIVATE KEY-----
mdraca
 
Posts: 2
Joined: Mon 26 Sep 2011 09:15

Postby Shalex » Fri 07 Oct 2011 16:48

Please visit http://www.devart.com/company/contact.html and attach your certificates (and mention the link to this thread).

I am getting "SSL connection error (2026): Cannot load client private key. [Invalid PEM header.]" with these certificates.
Shalex
Devart Team
 
Posts: 7290
Joined: Thu 14 Aug 2008 12:44


Return to dotConnect for MySQL