connection failed with drogon when mysql db is ssl required

[rafeeque1]

my mysql db is SSL enabled , when trying to connect it using drogon orm , its giving below error,

ERROR Error(2026) "TLS/SSL error: self-signed certificate in certificate chain" - MysqlConnection.cc:333

its because of

drogon/lib/src/HttpAppFrameworkImpl.cc

Line 988 in cbf63f8

addDbClient(orm::MysqlConfig{host,

here we are just providing generic info , not ssl/tls related information.
i am using ubuntu

[rafeeque1]

@an-tao please guide me on this, when mysql db is ssl/tls mode required then how to connect with db using config.json , in the orm codebase , i am not seeing any options to include ssl/tls related parameters.

[rafeeque1]

@an-tao you can see the connection string -> no ssl related info is passed ,

drogon/orm_lib/src/DbClientManager.cc

Line 211 in cbf63f8

auto cfg = std::get<MysqlConfig>(config);

[an-tao]

Currently, Drogon does not support the function to disable certificate verification in the MySQL client. You need to configure formal certificates issued by an SSL certificate authority on the server side instead of using self-signed certificates, or disable the SSL configuration.

[rafeeque1]

@an-tao i think mariadb-connector will take care the verification, we have to just provide the ssl information in connectionString ,
Example , if manually i am passing the connectionString with sslMode="required" then able to connect.

[an-tao]

@rafeeque1 You need to look at the relevant API of the client driver, and then refer to the postgresql processing in drogon to rewrite the mysql part.
Or I'll look into it when I have more time.

[rafeeque1]

@an-tao you mentioned somewhere in the comments that you are using drogon in production , then how are you handling database connection, and in production , db connection must be with SSL , but drogon doest not support SSL verification.

[an-tao]

@rafeeque1 I made a PR #2367 for this issue, would you please check it out?

[rafeeque1]

Thanks @an-tao , can you please share the format of connection-string which is tested by you for this changes along with ssl parameters?

[an-tao]

Thanks @an-tao , can you please share the format of connection-string which is tested by you for this changes along with ssl parameters?

see this：
//For PostgreSQL, see https://www.postgresql.org/docs/16/libpq-connect.html#LIBPQ-CONNECT-OPTIONS
//For MySQL, the valid options are:ssl_key, ssl_cert, ssl_ca, ssl_capath, ssl_cipher, see
//https://dev.mysql.com/doc/c-api/8.4/en/mysql-ssl-set.html
//"connect_options": { "statement_timeout": "1s" }