MySQL Bugs: #74896: Unable to create a connection without using SSL

Bug #74896	Unable to create a connection without using SSL
Submitted:	17 Nov 2014 8:55	Modified:	10 Jun 2017 0:28
Reporter:	Simon Mudd (OCA)	Email Updates:
Status:	No Feedback	Impact on me:	None
Category:	MySQL Workbench	Severity:	S3 (Non-critical)
Version:	6.2.3.12313	OS:	Any
Assigned to:		CPU Architecture:	Any
Tags:	failed connection, ssh

Description:
I want to connect to a remote mysql server and am using a ssh tunnel (I saw afterwards that it looks like this is possible directly in MySQL workbench but I'll look at that later).

So I configure a connection to the server via a tunnel on endpoint 127.0.0.1:3333. I don't want SSL as this is not needed and explicitly disable this in  Setup New Connection -> SSL -> Use SSL -> "No"

However, even so the connection test gives me an error message "SSL not enabled" which I don't want anyway.

Connecting by hand works fine:

[myuser@myhost ~]$ mysql --host=127.0.0.1 --user=myuser --port=3333 -p
Enter password: 
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 38548934
Server version: 5.6.14-log MySQL Community Server (GPL)
...

myuser@127.0.0.1 [(none)]> 

Maybe I'm misunderstanding the error message, but I do not think so.

How to repeat:
See above

Suggested fix:
If the SSL connection is configured as disabled then don't try to make an SSL connection and allow a normal one.

Error message implying that MySQL workbench wants to use SSL

Attachment: Screen Shot 2014-11-17 at 09.50.28.png (image/png, text), 58.72 KiB.

file showing the connection attempt

Attachment: Screen Shot 2014-11-17 at 09.50.19.png (image/png, text), 84.26 KiB.

I disable SSL explicitly

Attachment: Screen Shot 2014-11-17 at 09.49.39.png (image/png, text), 169.69 KiB.

Configuring the connection

Attachment: Screen Shot 2014-11-17 at 09.49.30.png (image/png, text), 126.37 KiB.

Connecting SSH tunnel

Attachment: tunneling.png (image/png, text), 234.02 KiB.

Connection parameters

Attachment: tunnel2.png (image/png, text), 157.03 KiB.

WorkBench using tunnel w/o SSL

Attachment: tunnel3.png (image/png, text), 149.20 KiB.

Thank you for the bug report. I couldn't repeat on MAC OSX and Windows 7 with tunnel with Linux CentOS 6.5. Please see the screen-shots I added to check what I did wrong. Thanks.

No feedback was provided for this bug for over a month, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".

Hi,

I think this is a comprehension problem.

"SSL not enabled" is an information message. But it's look like an error.

The popup should be clearer, like :

   ✓ The connection is successful

   ⚠ The server does not support SSL

Please try version 6.3.5. Thanks.

Workbench 6.3.5 tab:ssl with setting NO

Attachment: mysql-workbench-6.3-5--ssl-set-to-no.jpg (image/jpeg, text), 44.36 KiB.

This bug still exists in 6.3.5 build 201 (Windows x86). Even of SSL is set to NO, it request to use SSL on [test connection]. See attached images to this bug.

MySQL workbench 6.3.5 build 201 with SSL no test connection fails

Attachment: mysql-workbench-63.5--test-connection-after-ssl-is-set-to-no-v2.jpg (image/jpeg, text), 28.52 KiB.

Bug exists in version 6.3.5 build 201 for OS X, also.

This is still occuring.

It is happening to me trying to connect with SSL turned off from Windows 10 64bit to a Debian 7 64bit server running MySQL 5.5.46.

I explicitly turn SSL to "Off" but the ERROR message:
"SSL connection error: protocol version mismatch"
still occurs.

Please DO NOT tell me this is NOT a BUG.
HeidieSQL, DBeaver, PHPStorm, and three other DB "managers" can ALL connect to the EXACT same server using the EXACT same parameters without complaining about an "SSL connection error: protocol version mismatch" error.

PLEASE FIX THIS.

Version 6.0.9 of Workbench did NOT display this behaviour. This has only been occuring since I installed 6.3.5.

I cannot disable SSL, so I cannot use MySQL Workbench to connect to MySQL server! Need to find an old version of the workbench otherwise I'm out of luck.

It is happening to me trying to connect with SSL turned off from Windows
10 64bit to a Debian 7 64bit server running MySQL 5.5.46.

I explicitly turn SSL to "Off" but the ERROR message:
"SSL connection error: protocol version mismatch"
still occurs.

Please DO NOT tell me this is NOT a BUG.

Reverted to version 5.3.3 (named 5.3 CE during installation) and the option works as expected. An obvious bug, not sure why it's non-critical?

This is still a bug for version 6.3.6 build 517. I cannot connect without SSL, despite I chose Use SSL - No.
Error message is: SSL connection error: protocol version mismatch

Hello Cedric, Cezary, Sean, Clay, Jari,
thank you for the feedback. 
Could you please tell me what's the server version and if SSL is enabled on it.
Please also let me know what's SSL requirement for the user you're trying to use.

Information about SSL requirement for the user can be found here: 
https://dev.mysql.com/doc/refman/5.7/en/grant.html#idm140383924483296

No feedback was provided for this bug for over a month, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".

Thanks Marcin,

As far as I'm concerned the bug report is pretty clear.

It's impossible to NOT use SSL with latest version of the workbench, so the information you're requesting is pointless.

Can't remember the server version, but SSL is disabled on it.

The "user" is trying to use the workbench to connect to MySQL server without using SSL and that simply fails miserably.

The error message posted by the original poster, was simply a warning, but for version 6.3.6 build 511 CE 64bit OS X it is really broken. Workbench simply won't honour the SSL > NO setting. So it will always try to use SSL and fail.

This only affects me when connecting to remote servers running MySQL 5.1

I can successfully connect to MySQL 5.5 or 5.6 servers.

I am having the same issue when connecting to a 5.5 MySQL server hosted on Ubuntu 14.04. I have tried using 6.3.6 511 CE(64) MySQL Workbench client on both Ubuntu 16.04 and Windows 7, and I receive a: "SSL connection error" even though I have set Use SSL to NO in the Workbench.

I am able to connect through the linux command line by using the parameter --ssl-mode=DISABLED, and I am able to connect from MySQL workbench in Ubuntu 14.04.

Same problem with Workbench 6.3.7. I had to downgrade to 6.2.5 in order to connect to some servers that are not running SSL. It makes sense to encourage greater adoption of SSL, but the app is clearly broken if it does not allow you to connect to a server that is not running SSL at all.

I don't know if this has been resolved but...
The SSL "NO" switch is working for me now on MySQL Workbench CE 6.2.5 (Win 64) and on MySQL Server 5.5.49-0 deb8u1 on debian linux gnu 64 bit Linux.

This was a problem for me until the upgrade from 5.5.46 where the problem was still occuring.

From my side it seems this is a problem with older versions of MySQL and newer versions of MySQL Workbench CE not communicating the SSL switch correctly. It was working on older versions of MySQL Workbench CE, but is now working (for me) on the MySQL Server and Workbench CE combination above (first paragraph).

It does seem as if this is still a problem with the older MySQL / newer MySQL Workbench combinations. May I suggest an advisory to upgrade your version of MySQL Server to at least 5.5.49 or higher and see if the problem persists. Upgrading my server has seemed to solve this issue for me on at least three servers.

Regards,

Sean

@Sean Swanepoel
I had no troubles with 6.2.5.0 build 397 32bit OS X, but it doesn't work on 6.3.6 build 511 CE 64bit OS X. Regardless of the settings (Use SSL > No), Workbench will always try to use SSL and if the server handshake (erroneously) reports support for SSL, it will try and fail. So the setting Use-SSL is stuck in "If available" mode.

@Marcin...

On two of my servers giving the problem previously, the configuration was as follows:
Debian Linux 64-bit
MySQL Server 5.5.49
SSL Available
No SSL requirement for user.
MySQL Workbench 6.2.5 CE (build unknown) (64-bit Windows)

After upgrading both servers to MySQL Server 5.5.49 I can connect with MySQL Workbench 6.2.5 CE (build 397) (64bit Win). Server config is the same, only MySQL has been upgraded.

Regards,

Sean

That is an excellent suggestion, however, in my case I don't think it will be effective. I'm using Tungsten connector, and I suspect that it has the same problem as the older versions of MySQL server you mentioned. But, now at least I can open a bug report with the Tungsten folks as well.

Brandon, in your case it is the redirector. if you hit the host and ports directly it will work.

MySQL Workbench 6.37 on Kubuntu 16.04
Remote MySQL Server:
+-------------------------+------------------+
| Variable_name           | Value            |
+-------------------------+------------------+
| innodb_version          | 5.5.50           |
| protocol_version        | 10               |
| slave_type_conversions  |                  |
| version                 | 5.5.50-0+deb7u2  |
| version_comment         | (Debian)         |
| version_compile_machine | x86_64           |
| version_compile_os      | debian-linux-gnu |
+-------------------------+------------------+ 

OpenSSL> version                                                                                                             
OpenSSL 1.0.1e 11 Feb 2013   

---

It's not possible for me to connect to the server without SSL. Always get this error "SSL connection error: protocol version mismatch".

Shouldn't the severity setting for this bug be changed to a higher priority? For those who are affected this bug is a showstopper.

I am using MySQL Workbench 6.3.7 (OSX - macOS) and this bug is effecting me as well.

SSL is NOT used on my server.
I am SSH'ing into the server from MySQL Workbench.
MySQL Version 5.5.50 (MariaDB)
The use SSL setting in MySQL Workbench is set to NO.

The connection does not succeed - message is SSL Connection Error: Unknown Error Number.

SQL Log error:  161003 12:06:54 [Warning] Aborted connection 8874 to db: <secret> user: <secret> host: <secret> (Got an error reading communication packets)

Immediately (no other changes) rolling back to MySQL Workbench 6.3.3 works fine.

this bug report: http://bugs.mysql.com/bug.php?id=81977 seems to be related to this one or it might be a duplicate

Creating the files as described in https://dev.mysql.com/doc/refman/5.6/en/creating-ssl-files-using-openssl.html and adding:

ssl = on
ssl-ca = /etc/newcerts/ca.pem
ssl-cert = /etc/newcerts/server-cert.pem
ssl-key = /etc/newcerts/server-key.pem

in /etc/mysql/my.cnf in the [mysqld] section and then a restart of MySQL solved the problem.

Ewald provides 'a' solution. 

However, the defect is that the MySQL Workbench setting for the Connection "Use SSL" is set to NO yet fails with an SSL error. The server does not use SSL nor will our installation begin to use SSL. The ONLY mechanism by which the MySQL server can be reached is over an SSH tunnel

The selection of of "No" in the "Use SSL" setting should not cause an error on a non-SSL server.

The setting works as expected on MySQL Workbench 6.3.3 but does not work on 6.3.7. I have not tested on other versions.

Discovered on 3.6.7 and 3.6.8 there is a manual fix.

Find the sshtunnel.py file (on OSX /Applications/MySQLWorkbench.app/Contents/Resources)
Change TUNNEL_TIMEOUT = 60
Connections over ssh to a non-ssl server will now work.

Please try version 6.3.9. Thanks.

No feedback was provided for this bug for over a month, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".