Description:
When configuring group replication with SSL bootstrapping fails with this error in the error log:
2019-04-20T04:14:34.517624Z 0 [ERROR] [MY-011735] [Repl] Plugin group_replication reported: '[GCS] Expected hostname is '*.q-g81.bosh' but found the name 'q-m40n1s0.q-g81.bosh' in the server certificate'
2019-04-20T04:14:34.517810Z 0 [ERROR] [MY-011735] [Repl] Plugin group_replication reported: '[GCS] Error connecting to the local group communication engine instance.'
2019-04-20T04:14:34.532290Z 0 [ERROR] [MY-011735] [Repl] Plugin group_replication reported: '[GCS] The member was unable to join the group. Local port: 4306'
The certificates has the following subjects:
Subject: CN=*.q-g81.bosh
X509v3 Subject Alternative Name:
DNS:*.q-g81.bosh
This certificate works for asynchronous replication, but fails with group replication.
How to repeat:
Attempt to bootstrap group replication using SSL certificates contain a wildcard certificate or a certificate whose hostname is in the subject alternative name, but not the common name.
Suggested fix:
Support X509_check_host instead of a direct string comparison to the certificate common name similar to a "normal" MySQL client connection.
Description: When configuring group replication with SSL bootstrapping fails with this error in the error log: 2019-04-20T04:14:34.517624Z 0 [ERROR] [MY-011735] [Repl] Plugin group_replication reported: '[GCS] Expected hostname is '*.q-g81.bosh' but found the name 'q-m40n1s0.q-g81.bosh' in the server certificate' 2019-04-20T04:14:34.517810Z 0 [ERROR] [MY-011735] [Repl] Plugin group_replication reported: '[GCS] Error connecting to the local group communication engine instance.' 2019-04-20T04:14:34.532290Z 0 [ERROR] [MY-011735] [Repl] Plugin group_replication reported: '[GCS] The member was unable to join the group. Local port: 4306' The certificates has the following subjects: Subject: CN=*.q-g81.bosh X509v3 Subject Alternative Name: DNS:*.q-g81.bosh This certificate works for asynchronous replication, but fails with group replication. How to repeat: Attempt to bootstrap group replication using SSL certificates contain a wildcard certificate or a certificate whose hostname is in the subject alternative name, but not the common name. Suggested fix: Support X509_check_host instead of a direct string comparison to the certificate common name similar to a "normal" MySQL client connection.