tls abnormal for ticdc
- Dominant language
- Go
- Stars
- 40.5k
- Forks
- 6.2k
- PR merge metrics
- PR metrics pending
Description
## Bug Report
### 1. Minimal reproduce step (Required)
1. Generate certificate for MySQL 5.7
/opt/mysql/bin/mysql_ssl_rsa_setup --datadir=/etc/mysql --uid=mysql
chmod 777 /etc/mysql/*
```
-rwxrwxrwx 1 mysql mysql 1679 Aug 28 11:23 ca-key.pem
-rwxrwxrwx 1 mysql mysql 1107 Aug 28 11:23 ca.pem
-rwxrwxrwx 1 mysql mysql 1107 Aug 28 11:23 client-cert.pem
-rwxrwxrwx 1 mysql mysql 1679 Aug 28 11:23 client-key.pem
-rwxrwxrwx 1 mysql mysql 1679 Aug 28 11:23 private_key.pem
-rwxrwxrwx 1 mysql mysql 451 Aug 28 11:23 public_key.pem
-rwxrwxrwx 1 mysql mysql 1107 Aug 28 11:23 server-cert.pem
-rwxrwxrwx 1 mysql mysql 1679 Aug 28 11:23 server-key.pem
```
2. Modify my.cnf
```
[mysqld]
#require_secure_transport = ON
ssl-ca=/etc/mysql/ca.pem
ssl-cert=/etc/mysql/server-cert.pem
ssl-key=/etc/mysql/server-key.pem
```
3. Restart MySQL service
```
mysql> show variables like '%ssl%';
+---------------+----------------------------+
| Variable_name | Value |
+---------------+----------------------------+
| have_openssl | YES |
| have_ssl | YES |
| ssl_ca | /etc/mysql/ca.pem |
| ssl_capath | |
| ssl_cert | /etc/mysql/server-cert.pem |
| ssl_cipher | |
| ssl_crl | |
| ssl_crlpath | |
| ssl_key | /etc/mysql/server-key.pem |
+---------------+----------------------------+
9 rows in set (0.00 sec)
```
4. Check connection
mysql -h 172.18.104.207 -u sync_ssl -pxxxxxx --ssl-ca=/etc/mysql/ca.pem --ssl-cert=/etc/mysql/client-cert.pem --ssl-key=/etc/mysql/client-key.pem
Connection is normal.
5. Create changefeed of tls on ticdc
tiup cdc cli --server 172.18.104.207:8300 changefeed create --sink-uri="mysql://root:xxxxxx@172.18.104.207:3306/?ssl-ca=/etc/mysql/ca.pem&ssl-cert=/etc/mysql/client-cert.pem&ssl-key=/etc/mysql/client-key.pem" --changefeed-id="ssl-mysql-test" --config=/home/tidb/cdc-toml/test.toml
test.toml
```
[filter]
rules = ['dba_test.*']
[mounter]
worker-num = 16
```
**Got error:**
Error: [CDC:ErrMySQLConnectionError]fail to open MySQL connection: tls: failed to verify certificate: x509: cannot validate certificate for 172.18.104.207 because it doesn't contain any IP SANs
### 2. What did you expect to see? (Required)
Encryption data sync to MySQL using ticdc.
### 3. What did you see instead (Required)
### 4. What is your TiDB version? (Required) Release Version: v7.1.1
Edition: Community
Git Commit Hash: cf441574864be63938524e7dfcf7cc659edc3dd8
Git Branch: heads/refs/tags/v7.1.1
UTC Build Time: 2023-07-19 10:20:53
GoVersion: go1.20.6
Race Enabled: false
TiKV Min Version: 6.2.0-alpha
Check Table Before Drop: false
Store: tikv
Contributor guide
Assessment
This issue has not been assessed yet.