search for: mysql_opt_ssl_verify_server_cert

Hello, The following patch adds support for enabling MYSQL_OPT_SSL_VERIFY_SERVER_CERT. It makes the mysql client library check that the commonName in the server's SSL certificate matches the host name provided to mysql_real_connect() and aborts the connection if the name doesn't match. An example connect string would look something like: connect = ... ssl-ca=/path/to/ca...

...k. I get a certification verification error in handshake when connecting via IP. > But the cert is good as the connection via IP (and IP in the SAN of the cert) works from other applications verifying. > > Thanks. > Dovecot does consider SAN names too, but for MySQL driver, we use MYSQL_OPT_SSL_VERIFY_SERVER_CERT setting. Then you need to use ssl_ca or ssl_ca_path in the mysql driver config file to point to acceptable CAs. Aki

...I get a certification verification error in handshake when connecting via IP. But the cert is good as the connection via IP (and IP in the SAN of the cert) works from other applications verifying. Thanks. >>> >> Dovecot does consider SAN names too, but for MySQL driver, we use MYSQL_OPT_SSL_VERIFY_SERVER_CERT setting. Then you need to use ssl_ca or ssl_ca_path in the mysql driver config file to point to acceptable CAs. Aki >> -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://dovecot.org/pipermail/dovecot/attachments/20190418/3fc75f05/attachment-0001.html...