AWS shows ERROR 2026 (HY000): SSL connection error while trying to connect to Amazon Relational Database Service (Amazon RDS) DB instance or cluster using Secure Sockets Layer (SSL).

Here, at Bobcares, we assist our customers with several AWS queries as part of our AWS Support Services.

Today, let us see how to troubleshoot this error in different scenarios.

ERROR 2026 (HY000): SSL connection error

Generally, there are three different types of error messages for ERROR 2026.

Moving ahead, let us see the troubleshooting steps for each error message.

ERROR 2026 (HY000): SSL connection error: SSL certificate validation failure

In this case, initially, we validate we use the cluster endpoint or the DB instance endpoint.

Suppose we receive this error when trying to connect to the cluster endpoint. Then we try the endpoint of the primary DB instance in the connection string.

For example, we can connect to the cluster endpoint. Here, the cluster endpoint is abcdefg-clust.cluster-xxxx.us-east-1.rds.amazonaws.com. The DB instance endpoint is abcdefg-inst.xxxx.us-east-1.rds.amazonaws.com.

• Connect using the cluster endpoint:

[ec2-user@ip-192-0-2-0 ~]$ mysql -h abcdefg-clust.cluster-xxxx.us-east-1.rds.amazonaws.com --ssl-ca rds-combined-ca-bundle.pem --ssl-mode=VERIFY_IDENTITY -u test -p test
Enter password:
ERROR 2026 (HY000): SSL connection error: SSL certificate validation failure

• Connect using the DB instance endpoint:

[ec2-user@ip-192-0-2-0 ~]$ mysql -h abcdefg-inst.xxxx.us-east-1.rds.amazonaws.com --ssl-ca rds-combined-ca-bundle.pem
--ssl-mode=VERIFY_IDENTITY -u test -p test
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 26

ERROR 2026 (HY000): SSL connection error: Server doesn’t support SSL

On the other hand, we may receive this error if the server or engine version we use doesn’t support SSL.

To resolve this error, we migrate to an engine that supports SSL connections.

ERROR 2026 (HY000): SSL connection error: ASN: bad other signature confirmation

An incorrect certificate identifier can result in this error.

In addition, there is a possibility of this error if the MySQL client does not support the certificate identifier.

Ensure correct certificate identifier name and the correct path to the certificate to connect successfully. We confirm we have the correct certificate before proceeding to connect.

The root certificate file is in the Downloads directory in an Amazon EC2 instance.

For example, an incorrect path below results in ERROR 2026:

[ec2-user@ip-192-0-2-0 ~]$ mysql -h abcdefg-clust.cluster-xxxxx.us-east-1.rds.amazonaws.com --ssl-ca rds-combined-ca-bundle.pem --ssl-mode=VERIFY_IDENTITY -u test -p test
Enter password:
ERROR 2026 (HY000): SSL connection error: SSL_CTX_set_default_verify_paths failed

In the following example, we use the correct path to the root certificate and it connects successfully:

[ec2-user@ip-192-0-2-0 ~]$ mysql -h abcdefg-clust.cluster-xxxx.us-east-1.rds.amazonaws.com --ssl-ca /home/ec2-user/Downloads/rds-combined-ca-bundle.pem
--ssl-mode=VERIFY_IDENTITY -u test -p test
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 26

On the other hand, we may receive this error if we don’t have permission to the directory that the certificate is stored in. So we ensure the certificate is in a directory that we have permission to access.

See the following examples to connect with and without permissions:

• Connect with insufficient permissions:

[ec2-user@ip-192-0-2-0 ~]$ sudo chmod 700 rds-combined-ca-bundle.pem 
[ec2-user@ip-192-0-2-0 ~]$ mysql -h abcdefg-inst.xxxx.us-east-1.rds.amazonaws.com --ssl-ca rds-combined-ca-bundle.pem --ssl-mode=VERIFY_IDENTITY -u test -p test
Enter password: 
ERROR 2026 (HY000): SSL connection error: SSL_CTX_set_default_verify_paths failed

• Connect with the correct permissions:

[ec2-user@ip-192-0-2-0 ~]$ sudo chmod 755 rds-combined-ca-bundle.pem
[ec2-user@ip-192-0-2-0 ~]$ mysql -h abcdefg-inst.xxxx.us-east-1.rds.amazonaws.com --ssl-ca rds-combined-ca-bundle.pem --ssl-mode=VERIFY_IDENTITY -u test -p test
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 810

[Stuck with the connections? We’d be happy to help you]

Conclusion

In short, we saw how our Support Techs fix the AWS ERROR 2026 (HY000): SSL connection error.