Description:
The bundled test suite ships static, pre-generated TLS fixtures at tests/data/ssl/:
- tests_CA_cert.pem
- tests_server_cert.pem
- tests_client_cert.pem
tests_server_cert.pem and tests_client_cert.pem have a validity window of exactly one year from generation:
notBefore=Jul 23 14:50:07 2025 GMT
notAfter=Jul 23 14:50:07 2026 GMT
Any user who runs the full unittest suite (unittests.py) against a released source tarball more than ~1 year after these fixtures were generated will hit TLS handshake failures in any test exercising the "good" (non-expired) server/client cert pair, e.g. tests/qa/test_qa_ciphers.py::test_tls_v13_ciphers.
This was found while packaging mysql-connector-python 26.7.0 for Fedora and running mockbuild --with tests for release validation; it is not something end users of the published wheel/package would normally hit, since the test suite isn't run by default, but it affects any downstream packager or CI system that validates the source distribution's own test suite.
How to repeat:
1. Run the bundled test suite: python unittests.py --with-mysql=<mysql_prefix> --verbosity=1.
2. Observe failures such as:
ssl.SSLError: [SSL: TLS_ALERT_CERTIFICATE_EXPIRED] tls alert certificate expired (_ssl.c:3030)
...
mysql.connector.errors.OperationalError: 2055: Lost connection to MySQL server at '127.0.0.1:3306',
system error: Errno 1: [SSL: TLS_ALERT_CERTIFICATE_EXPIRED] tls alert certificate expired (_ssl.c:3030)
in tests/qa/test_qa_ciphers.py::test_tls_v13_ciphers and likely other TLS-dependent tests in the qa module.
3. Confirm the cert dates: openssl x509 -in tests/data/ssl/tests_server_cert.pem -noout -dates shows a notAfter in the past.
Suggested fix:
Either ideally generate the TLS test fixtures (CA, server cert/key, client cert/key) dynamically at test setup time.
Or extend the validity window well beyond any expected support lifetime for a given release tarball (e.g. 10+ years, matching what's already done for tests_CA_cert.pem, which is valid until 2034).
