[CentOS] mysql client ssl connection failure

Sun Jul 19 17:51:41 UTC 2015
Devin Reade <gdr at gno.org>

The problem and solution is posted here for posterity.

On a production CentOS 5.11 system, I recently had a cron job
that started failing.  One of the thing that the cron job does
is connect to a MySQL server via TCP using SSL.

Debugging things got me to the point where invoking the mysql
client would result in:

% mysql
ERROR 2026 (HY000): SSL connection error

(Not exactly informative.)  Given that there have been recent openssl
updates, I figured the problem was there, however the lack of any
decent debug output from mysql/openssl made it hard to figure out.
After going down a few false starts, including looking at the SSL
certificate and root CA, I found this:


It turns out that the default cipher for the mysql client is
hardcoded, and the one specified is no longer supported in the
server.  The solution is to add to /etc/my.cnf (or ~/.my.cnf)
the following (or the equivalent for your preferred cipher) to
the client section(s):