apache / apache/incubator-seata

Unable to connect to AWS RDS MySQL

Open
#2,990 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
26k
Forks
8.8k
Avg merge
1d 8h
Merged PRs (30d)
4

Description

- [X] I have searched the [issues](https://github.com/seata/seata/issues) of this repository and believe that this is not a duplicate.

### Ⅰ. Issue Description
Unable to connect to AWS RDS MySQL (Inbound rules - All Traffic, Outbound Rules - All Traffic)

### Ⅱ. Describe what happened

I am using Seata 1.3.0 using the DB configuration. I have created an AWS MySQL instance which is successfully connected through the local machine ( MySQL Workbench). But when I configure the same DB Details in the seata file.conf the connection fails. Below is the configuration details

```json
db {
## the implement of javax.sql.DataSource, such as DruidDataSource(druid)/BasicDataSource(dbcp)/HikariDataSource(hikari) etc.
datasource = "druid"
## mysql/oracle/postgresql/h2/oceanbase etc.
dbType = "mysql"
driverClassName = "com.mysql.jdbc.Driver"
url = "jdbc:mysql://instance1.XXXXXXX.ap-south-1.rds.amazonaws.com:3306/seata?sslMode=PREFERRED&useSSL=true&requireSSL=false"
user = "XXXXXXX"
password = "XXXXXXXXXXXX"
minConn = 10
maxConn = 100
globalTable = "global_table"
branchTable = "branch_table"
lockTable = "lock_table"
queryLimit = 100
maxWait = 5000
}
```

I have tried with the all the possible options of the flags in the db connections string. Below is the stack trace of the error

If there is an exception, please attach the exception trace:

```
2020-08-07 19:58:08.867 ERROR --- [ main] com.alibaba.druid.pool.DruidDataSource : init datasource error, url: jdbc:mysql://instance1.cxuyzosdk3ux.ap-south-1.rds.amazonaws.com:3306/seata?sslMode=PREFERRED&useSSL=true&requireSSL=false
==>
com.mysql.jdbc.exceptions.jdbc4.CommunicationsException: Communications link failure

The last packet successfully received from the server was 263 milliseconds ago. The last packet sent successfully to the server was 256 milliseconds ago.
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
at com.mysql.jdbc.Util.handleNewInstance(Util.java:389)
at com.mysql.jdbc.SQLError.createCommunicationsException(SQLError.java:1038)
at com.mysql.jdbc.ExportControlled.transformSocketToSSLSocket(ExportControlled.java:110)
at com.mysql.jdbc.MysqlIO.negotiateSSLConnection(MysqlIO.java:4760)
at com.mysql.jdbc.MysqlIO.proceedHandshakeWithPluggableAuthentication(MysqlIO.java:1629)
at com.mysql.jdbc.MysqlIO.doHandshake(MysqlIO.java:1206)
at com.mysql.jdbc.ConnectionImpl.coreConnect(ConnectionImpl.java:2239)
at com.mysql.jdbc.ConnectionImpl.connectOneTryOnly(ConnectionImpl.java:2270)
at com.mysql.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:2069)
at com.mysql.jdbc.ConnectionImpl.(ConnectionImpl.java:794)
at com.mysql.jdbc.JDBC4Connection.(JDBC4Connection.java:44)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
at com.mysql.jdbc.Util.handleNewInstance(Util.java:389)
at com.mysql.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:399)
at com.mysql.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:325)
at com.alibaba.druid.pool.DruidAbstractDataSource.createPhysicalConnection(DruidAbstractDataSource.java:1570)
at com.alibaba.druid.pool.DruidAbstractDataSource.createPhysicalConnection(DruidAbstractDataSource.java:1636)
at com.alibaba.druid.pool.DruidDataSource.init(DruidDataSource.java:874)
at com.alibaba.druid.pool.DruidDataSource.getConnection(DruidDataSource.java:1246)
at com.alibaba.druid.pool.DruidDataSource.getConnection(DruidDataSource.java:1242)
at com.alibaba.druid.pool.DruidDataSource.getConnection(DruidDataSource.java:89)
at io.seata.server.storage.db.store.LogStoreDataBaseDAO.queryTableStructure(LogStoreDataBaseDAO.java:461)
at io.seata.server.storage.db.store.LogStoreDataBaseDAO.initTransactionNameSize(LogStoreDataBaseDAO.java:445)
at io.seata.server.storage.db.store.LogStoreDataBaseDAO.(LogStoreDataBaseDAO.java:106)
at io.seata.server.storage.db.store.DataBaseTransactionStoreManager.(DataBaseTransactionStoreManager.java:98)
at io.seata.server.storage.db.store.DataBaseTransactionStoreManager.getInstance(DataBaseTransactionStoreManager.java:83)
at io.seata.server.storage.db.session.DataBaseSessionManager.init(DataBaseSessionManager.java:80)
at io.seata.common.loader.EnhancedServiceLoader$InnerEnhancedServiceLoader.initInstance(EnhancedServiceLoader.java:576)
at io.seata.common.loader.EnhancedServiceLoader$InnerEnhancedServiceLoader.createNewExtension(EnhancedServiceLoader.java:402)
at io.seata.common.loader.EnhancedServiceLoader$InnerEnhancedServiceLoader.getExtensionInstance(EnhancedServiceLoader.java:395)
at io.seata.common.loader.EnhancedServiceLoader$InnerEnhancedServiceLoader.loadExtension(EnhancedServiceLoader.java:360)
at io.seata.common.loader.EnhancedServiceLoader$InnerEnhancedServiceLoader.load(EnhancedServiceLoader.java:249)
at io.seata.common.loader.EnhancedServiceLoader$InnerEnhancedServiceLoader.access$200(EnhancedServiceLoader.java:190)
at io.seata.common.loader.EnhancedServiceLoader.load(EnhancedServiceLoader.java:82)
at io.seata.server.session.SessionHolder.init(SessionHolder.java:87)
at io.seata.server.Server.main(Server.java:84)
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1946)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:316)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:310)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1639)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:223)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:965)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1064)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1367)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1395)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1379)
at com.mysql.jdbc.ExportControlled.transformSocketToSSLSocket(ExportControlled.java:95)
... 36 common frames omitted
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397)
at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302)
at sun.security.validator.Validator.validate(Validator.java:262)
at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:330)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:237)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:132)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1621)
... 44 common frames omitted
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392)
... 50 common frames omitted
<==

2020-08-07 19:58:08.874 ERROR --- [ main] com.alibaba.druid.pool.DruidDataSource : {dataSource-1} init error
==>
com.mysql.jdbc.exceptions.jdbc4.CommunicationsException: Communications link failure

```

### Ⅲ. Describe what you expected to happen
Expected to connect successfully by verifying the certificate

### Ⅳ. How to reproduce it (as minimally and precisely as possible)

1. create DB with SSL
2. Try connecting with SSL option from Seata

### Ⅴ. Anything else we need to know?
No

### Ⅵ. Environment:

- JDK version : 8
- OS : MacOS
- Others:

Contributor guide

Open the contributing guide

Research direction

Start with the db section of file.conf and the SSLHandshakeException in the attached stack trace, then trace the connection through Druid to LogStoreDataBaseDAO. Reproduce the AWS RDS MySQL connection on JDK 8 and determine whether Seata's configuration or its connection setup needs a change; done means the reported SSL connection succeeds with certificate verification.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, java, mysql
Domain
backend, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.