title: Why can JDBC connect to MySQL when SSL has been configured, without having the cert
body: <p>My issue is I seem to have secured MySQL from the command line, yet when I connect through JDBC that same restriction falls away. I'm a beginner to using SSL for my database connection, this is the first time I've tried to set it up.</p>
  <p>I setup SSL for MySQL locally on my Linux machine. I generated the certificates, editing my.cnf, etc.</p>
  <p>Here is what I added to my my.cnf:</p>
  <pre><code>[mysqld]
  ssl-ca=/var/lib/mysql/cert/ca-cert.pem
  ssl-cert=/var/lib/mysql/cert/server-cert.pem
  ssl-key=/var/lib/mysql/cert/server-key.pem
  </code></pre>
  <p>Right there are valid paths to my server cert/key, and my CA cert. It's self-signed. I'll get to having a more official one when I need it.</p>
  <p>In the MySQL database, I set my database user account to require SSL:</p>
  <pre><code>GRANT ALL PRIVILEGES ON *.* TO ‘orgapi’@’localhost’
  IDENTIFIED BY ‘password’ REQUIRE SSL;
  </code></pre>
  <p>So far so good. Once that user requires SSL, MySQL seems to require a client cert to be provided when making the connection. I generated that cert as well, signing it with the same self-signed CA cert.</p>
  <p>Now, for the first test: I tried logging in from the command line WITHOUT the client cert:</p>
  <pre><code>mysql -u orgapi -p -h localhost
  </code></pre>
  <p>Voila, it fails to let me log in. However, when I include the SSL cert in the login command, like this:</p>
  <p><code>mysql --ssl-ca=ca-cert.pem --ssl-cert=client-cert.pem --ssl-key=client-key.pem -u orgapi -p -h localhost</code></p>
  <p>It works like a charm. I'm able to connect when I specify the client cert, and if I do a &quot;status&quot; command, it says I'm connected using SSL.</p>
  <h2>The problem</h2>
  <p>To ensure that everything was all set to go, I threw together some basic test code using JDBC. Currently, I'm not providing the client certs to this JDBC code. Because of that, I would expect the connection to fail.</p>
  <pre><code>public static void main(String[] args) throws Exception{
          Connection conn = DriverManager.getConnection(&quot;jdbc:mysql://localhost:3306&quot;, &quot;orgapi&quot;, &quot;orgapi&quot;);
          conn.setCatalog(&quot;org_app&quot;);
          Statement stmt = conn.createStatement();
          ResultSet resultSet = stmt.executeQuery(&quot;select * from users&quot;);
          while(resultSet.next()){
              System.out.println(resultSet.getString(1) + &quot; &quot; + resultSet.getString(2));
          }
      }
  </code></pre>
  <p>What worries me is that it doesn't fail. In fact, it executes the query without any issue. Now, if I append to the end of the database url &quot;?useSSL=true&quot;, then it will fail to connect because it doesn't have the cert. But it still concerns me that JDBC code would be able to connect to MySQL and bypass the restrictions that exist elsewhere.</p>
  <p>So I'm just wondering what I may be doing wrong, or what I don't understand about this process. I just want to be sure that I'm not leaving my database less secure somehow.</p>
  <h2>Edit</h2>
  <p>I do get this interesting log message when I'm using JDBC:</p>
  <blockquote>
  <p>Sun Oct 23 08:58:28 EDT 2016 WARN: Establishing SSL connection without
  server's identity verification is not recommended. According to MySQL
  5.5.45+, 5.6.26+ and 5.7.6+ requirements SSL connection must be established by default if explicit option isn't set. For compliance
  with existing applications not using SSL the verifyServerCertificate
  property is set to 'false'. You need either to explicitly disable SSL
  by setting useSSL=false, or set useSSL=true and provide truststore for
  server certificate verification.</p>
  </blockquote>