peewee mysql SSL：CERTIFICATE_VERIFY_FAILED

Question

python 3.4.3、pymysql 0.6.7 和 0.7.1、mysql 5.5.23 和 5.5.4x 无法使用 ssl 选项连接到 mysql。 使用 mysql 工作台和 mysql-client 安全连接可以正常工作。 我已经在 debian 和 windows 的两台 mysql 服务器上测试过了

这里是代码和解释

制作证书

openssl genrsa 2048 > ca-key.pem; \
openssl req -sha1 -new -x509 -nodes -days 3650 -key ca-key.pem > ca-cert.pem; \
openssl req -sha1 -newkey rsa:2048 -days 730 -nodes -keyout server-key.pem > server-req.pem; \
openssl x509 -sha1 -req -in server-req.pem -days 730  -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-cert.pem; \
openssl rsa -in server-key.pem -out server-key.pem; \
openssl req -sha1 -newkey rsa:2048 -days 730 -nodes -keyout client-key.pem > client-req.pem; \
openssl x509 -sha1 -req -in client-req.pem -days 730 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > client-cert.pem; \
openssl rsa -in client-key.pem -out client-key.pem;

用户创建

CREATE DATABASE dbname;
GRANT ALL PRIVILEGES ON dbname.* TO 'u1'@'%' IDENTIFIED BY '12345' REQUIRE SSL;
FLUSH PRIVILEGES;

代码

from __future__ import print_function
import pymysql

#conn = pymysql.connect(host='localhost', port=3306, user='root', passwd='', db='mysql')
conn = pymysql.connect(host='localhost', port=3306, user='u1', passwd='12345', db='dbname', ssl = {'key': 'ssl/client-key.pem', 'cert': 'ssl/client-cert.pem', 'ca': 'ssl/ca-cert.pem'})

cur = conn.cursor()
#cur.execute("SELECT Host,User FROM user")
cur.execute("SHOW TABLES")

print(cur.description)
print()
for row in cur:
    print(row)
cur.close()
conn.close()

错误

Traceback (most recent call last):
  File "C:\Python34\lib\site-packages\pymysql\connections.py", line 851, in connect
    self._request_authentication()
  File "C:\Python34\lib\site-packages\pymysql\connections.py", line 1017, in _request_authentication
    ca_certs=self.ca)
  File "C:\Python34\lib\ssl.py", line 890, in wrap_socket
    ciphers=ciphers)
  File "C:\Python34\lib\ssl.py", line 580, in __init__
    self.do_handshake()
  File "C:\Python34\lib\ssl.py", line 807, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:600)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:/Users/User/Py/prjct/test.py", line 24, in <module>
    conn = pymysql.connect(host='localhost', port=3306, user='u1', passwd='12345', db='dbname', ssl = {'key': 'ssl/client-key.pem', 'cert': 'ssl/client-cert.pem', 'ca': 'ssl/ca-cert.pem'})
  File "C:\Python34\lib\site-packages\pymysql\__init__.py", line 88, in Connect
    return Connection(*args, **kwargs)
  File "C:\Python34\lib\site-packages\pymysql\connections.py", line 657, in __init__
    self.connect()
  File "C:\Python34\lib\site-packages\pymysql\connections.py", line 882, in connect
    raise exc
pymysql.err.OperationalError: (2003, "Can't connect to MySQL server on 'localhost' ([SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:600))")

更新： 我错过了这部分说明：

```
Whatever method you use to generate the certificate and key files, the Common Name value used for the server and client certificates/keys must each differ from the Common Name value used for the CA certificate. Otherwise, the certificate and key files will not work for servers compiled using OpenSSL.
```

当 OpenSSL 提示您输入每个证书的通用名称时，请使用不同的名称。

但是它会帮助并引发新的错误： 首先 - dhkey 还不够，我正在更新测试 mysql 服务器以持续 5.7.11 它有助于并引发常见名称不匹配 localhost 的新错误 我已经用新的通用名称localhost重新生成证书@

它再次向我显示错误 - ([SSL: CERTIFICATE_VERIFY_FAILED] 证书验证失败 (_ssl.c:600))

Answer 1

尝试：

conn = pymysql.connect(host='localhost', port=3306, user='u1', passwd='12345', db='dbname', ssl={'ssl': {'key':' ssl/client-key.pem', 'cert': 'ssl/client-cert.pem', 'ca': 'ssl/ca-cert.pem'}})

有同样的问题，它对我有用。

Answer 2

这可能不会直接回答您的问题，但我相信使用 mysql-python 存在一些与版本冲突问题相关的问题。我设法使用以下 Anaconda/Pip 版本通过 peewee（使用 ssl）进行连接：

python                    2.7.15               h9bab390_6
pymysql                   0.9.3                    py27_0 
mysql-connector-c         6.1.11               h597af5e_0  
mysql-connector-python    8.0.12           py27haf6c83e_0
peewee                    3.8.2                    pypi_0    pypi

为了完整起见，我通过以下方式使用 SSL 连接到 Google Cloud 实例：

import pewee as pw
from os.path import expanduser

home = expanduser("~")

perms = {'key': home+'/ssl/client-key.pem', 
         'cert': home+'/ssl/client-cert.pem', 
         'ca': home+'/ssl/server-ca.pem',
         'check_hostname': False}

mysql_db = pw.MySQLDatabase(database=os.environ['GCP_DBNAME'],
                            host=os.environ['GCP_HOST'],
                            user=os.environ['GCP_USER'],
                            passwd=os.environ['GCP_PASS'],
                            ssl=perms)

希望这可以帮助遇到同样错误的其他人。更新的版本似乎也适用于 Python 3.5。我在 Ubuntu 16.04 上。