search

sysown / proxysql

High-performance MySQL proxy with a GPL license.
http://www.proxysql.com
GNU General Public License v3.0
5.95k stars 970 forks source link

Proxysql uses default cipher on updating ssl_p2s_cipher to ECDHE-ECDSA-AES256-GCM-SHA384 #3956

Open qadqdew opened 2 years ago

qadqdew commented 2 years ago

I need to enable SSL only for front-end connections. Sharing the configuration for better clarity.

+----------------------+-------------------------------+ | variable_name | variable_value | +----------------------+-------------------------------+ | mysql-ssl_p2s_cipher | ECDHE-ECDSA-AES256-GCM-SHA384 | +----------------------+-------------------------------+ 1 row in set (0.00 sec)

mysql/bin/mysql -uadmin -p -P6032 -h127.0.0.1 -e '\s' | grep -P 'SSL|Connection' Connection id: 1441 SSL: Cipher in use is DHE-RSA-AES256-SHA Connection: 127.0.0.1 via TCP/IP```

From this I could see only default cipher is used in front-end connections.

On explicitly mentioning --ssl --ssl-cipher=ECDHE-ECDSA-AES256-GCM-SHA384 Getting SSL connection error: Failed to set ciphers to use.

Able to connect only with default cipher.

amickael commented 5 months ago

Also experiencing this issue, changing ssl_p2s_cipher seems to have no effect, it continues to use the default cipher.