sidorares / sidorares/node-mysql2
ERR_TLS_CERT_ALTNAME_INVALID error when using CNAME as host name for RDS connection
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 4.4k
- Forks
- 680
- Avg merge
- 9h 7m
- Merged PRs (30d)
- 59
Description
We have a CNAME set in Route53 for our RDS cluster. When using that CNAME as host for MySQL connection we are getting ERR_TLS_CERT_ALTNAME_INVALID error (Hostname/IP does not match certificate's altnames).
SSL option in configuration is set to ssl: 'Amazon RDS'.
This is because the certificate from RDS doesn't have the CNAME listed as altname and AFAIK there is no way to do that in RDS.
This was working fine in mysql2 3.5.0 and broke in 3.5.1 with #2119 and the switch to Tls.connect.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the TLS connection change in #2119 and the code path used when ssl: 'Amazon RDS' is configured. Reproduce the connection with an RDS Route53 CNAME and compare behavior between mysql2 3.5.0 and 3.5.1. Done means the reported CNAME case works while certificate validation remains intact for other hosts.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- mysql, node.js, typescript
- Domain
- backend, databases, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100