title: Mysql SSL connection specific problem with using certificates
body: <p>ISSUE: I cant establish connection between remote MySql server and my local computer when i try to use certificates.</p>
  <ul>
  <li>Mysql Version: Ver 14.14 Distrib 5.7.31, for Linux (x86_64) using  EditLine wrapper</li>
  <li>buntu 18.04.3 LTS</li>
  </ul>
  <p>I have created new Mysql instance on new Ubuntu server. i have created User By script:</p>
  <pre><code>CREATE USER 'sammy'@'MY_COMPUTER_IP' IDENTIFIED WITH mysql_native_password BY 'password';
  </code></pre>
  <p>When i type <code>SHOW GLOBAL VARIABLES LIKE '%ssl%';</code> I see:</p>
  <pre><code>+---------------+--------------------------------+
  | Variable_name | Value                          |
  +---------------+--------------------------------+
  | have_openssl  | YES                            |
  | have_ssl      | YES                            |
  | ssl_ca        | /var/lib/mysql/ca.pem          |
  | ssl_capath    |                                |
  | ssl_cert      | /var/lib/mysql/server-cert.pem |
  | ssl_cipher    |                                |
  | ssl_crl       |                                |
  | ssl_crlpath   |                                |
  | ssl_key       | /var/lib/mysql/server-key.pem  |
  +---------------+--------------------------------+
  </code></pre>
  <p>I can see also there are (by default) certificates located in /var/lib/mysql/:</p>
  <pre><code>root@xxxxxx:/var/log/mysql# sudo find /var/lib/mysql -name '*.pem' -ls
     258224      4 -rw-------   1 mysql    mysql        1676 Aug 12 15:34 /var/lib/mysql/server-key.pem
     258226      4 -rw-------   1 mysql    mysql        1680 Aug 12 15:34 /var/lib/mysql/client-key.pem
     258225      4 -rw-------   1 mysql    mysql        1112 Aug 12 15:34 /var/lib/mysql/server-cert.pem
     258227      4 -rw-------   1 mysql    mysql        1112 Aug 12 15:34 /var/lib/mysql/client-cert.pem
     258223      4 -rw-------   1 mysql    mysql        2224 Aug 12 17:01 /var/lib/mysql/ca.pem
     258523      4 -rw-------   1 mysql    mysql         452 Aug 12 15:34 /var/lib/mysql/public_key.pem
     258495      4 -rw-------   1 mysql    mysql        1680 Aug 12 15:34 /var/lib/mysql/private_key.pem
     258222      4 -rw-------   1 mysql    mysql        1676 Aug 12 15:34 /var/lib/mysql/ca-key.pem
  </code></pre>
  <p>its how my /etc/mysql/my.cnf file looks like:</p>
  <pre><code>!includedir /etc/mysql/conf.d/
  !includedir /etc/mysql/mysql.conf.d/
  [mysqld]
  require_secure_transport = ON
  bind-address = thie_is_myserver_address_ip
          
  ssl-ca=/var/lib/mysql/ca.pem
  ssl-cert=/var/lib/mysql/server-cert.pem
  ssl-key=/var/lib/mysql/server-key.pem
  </code></pre>
  <p>after changes I run:</p>
  <pre><code>sudo systemctl restart mysql
  </code></pre>
  <p>I have copied following certificates to my local computer:</p>
  <pre><code> - /var/lib/mysql/ca.pem
   - /var/lib/mysql/client-cert.pem
   - /var/lib/mysql/client-key.pem
  </code></pre>
  <p>I tried to log in by mysqlWorkbench by using login, password and I have added those 3 certificates into SSL Tab With no luck...</p>
  <p><strong>Now i receiver Error:</strong></p>
  <pre><code>SSL connection error: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca
  </code></pre>
  <p>Error logs (/var/log/mysql/error.log):</p>
  <pre><code>2020-08-12T20:22:48.398042Z 0 [Warning] TIMESTAMP with implicit DEFAULT value is deprecated. Please use --explicit_defaults_for_timestamp server option (see documentation for more details).
  2020-08-12T20:22:48.400817Z 0 [Note] /usr/sbin/mysqld (mysqld 5.7.31-0ubuntu0.18.04.1) starting as process 6428 ...
  2020-08-12T20:22:48.407237Z 0 [Note] InnoDB: PUNCH HOLE support available
  2020-08-12T20:22:48.407288Z 0 [Note] InnoDB: Mutexes and rw_locks use GCC atomic builtins
  2020-08-12T20:22:48.407302Z 0 [Note] InnoDB: Uses event mutexes
  2020-08-12T20:22:48.407312Z 0 [Note] InnoDB: GCC builtin __atomic_thread_fence() is used for memory barrier
  2020-08-12T20:22:48.407322Z 0 [Note] InnoDB: Compressed tables use zlib 1.2.11
  2020-08-12T20:22:48.407332Z 0 [Note] InnoDB: Using Linux native AIO
  2020-08-12T20:22:48.407814Z 0 [Note] InnoDB: Number of pools: 1
  2020-08-12T20:22:48.407982Z 0 [Note] InnoDB: Using CPU crc32 instructions
  2020-08-12T20:22:48.412789Z 0 [Note] InnoDB: Initializing buffer pool, total size = 128M, instances = 1, chunk size = 128M
  2020-08-12T20:22:48.426101Z 0 [Note] InnoDB: Completed initialization of buffer pool
  2020-08-12T20:22:48.429598Z 0 [Note] InnoDB: If the mysqld execution user is authorized, page cleaner thread priority can be changed. See the man page of setpriority().
  2020-08-12T20:22:48.442195Z 0 [Note] InnoDB: Highest supported file format is Barracuda.
  2020-08-12T20:22:48.457283Z 0 [Note] InnoDB: Creating shared tablespace for temporary tables
  2020-08-12T20:22:48.457488Z 0 [Note] InnoDB: Setting file './ibtmp1' size to 12 MB. Physically writing the file full; Please wait ...
  2020-08-12T20:22:48.497583Z 0 [Note] InnoDB: File './ibtmp1' size is now 12 MB.
  2020-08-12T20:22:48.499136Z 0 [Note] InnoDB: 96 redo rollback segment(s) found. 96 redo rollback segment(s) are active.
  2020-08-12T20:22:48.499162Z 0 [Note] InnoDB: 32 non-redo rollback segment(s) are active.
  2020-08-12T20:22:48.499694Z 0 [Note] InnoDB: Waiting for purge to start
  2020-08-12T20:22:48.550043Z 0 [Note] InnoDB: 5.7.31 started; log sequence number 2721125
  2020-08-12T20:22:48.550897Z 0 [Note] Plugin 'FEDERATED' is disabled.
  2020-08-12T20:22:48.556599Z 0 [Note] InnoDB: Loading buffer pool(s) from /var/lib/mysql/ib_buffer_pool
  2020-08-12T20:22:48.559994Z 0 [Note] InnoDB: Buffer pool(s) load completed at 200812 20:22:48
  2020-08-12T20:22:48.569386Z 0 [Note] Skipping generation of SSL certificates as options related to SSL are specified.
  2020-08-12T20:22:48.570843Z 0 [Note] Skipping generation of RSA key pair as key files are present in data directory.
  2020-08-12T20:22:48.571010Z 0 [Note] Server hostname (bind-address): 'xx.xxx.xx.xx'; port: 3306
  2020-08-12T20:22:48.571043Z 0 [Note]   - 'xxx.xxx.xxx.xxx' resolves to 'xx.xx.xx.xx';
  2020-08-12T20:22:48.571103Z 0 [Note] Server socket created on IP: 'xx.xx.xx.xx'.
  2020-08-12T20:22:48.588243Z 0 [Note] Event Scheduler: Loaded 0 events
  2020-08-12T20:22:48.588702Z 0 [Note] /usr/sbin/mysqld: ready for connections.
  Version: '5.7.31-0ubuntu0.18.04.1'  socket: '/var/run/mysqld/mysqld.sock'  port: 3306  (Ubuntu)
  2020-08-12T20:23:23.485022Z 2 [Note] Bad handshake
  2020-08-12T20:24:27.578481Z 3 [Note] Bad handshake
  </code></pre>
  <p>When I try to connect locally to the remote server by add config for client (in /etc/mysql/my.cnf file):</p>
  <pre><code>[client]
  ssl-ca=/var/lib/mysql/ca.pem
  ssl-cert=/var/lib/mysql/client-cert.pem
  ssl-key=/var/lib/mysql/client-key.pem
  </code></pre>
  <p>And I reset mysql and I try to login loccally i receive:</p>
  <pre><code>root@xxxxxx:/var/log/mysql# mysql -u root -p
  Enter password:
  ERROR 2026 (HY000): SSL connection error: error:00000001:lib(0):func(0):reason(1) 
  </code></pre>
  <p>When i remove cert paths from my.cnf file it works corectlly withopu certificates.
  But i have to run this with sertificates.</p>
  <p>What im I doing wrong? Thank you in advice!</p>