URGENT | MariaDB crashed after hitting "set as default services certificate" button

Virtualmin
41

did you check the etc location, maybe that the issue.

42

when webmin generates the cert & key they are placed in /etc/mysql and not /etc 


43

ok, thought it may copy to etc and config for /etc/mysql using old ssl’s

44

no it does not however I have edited the config file to point to that webmin generated cert & maria fails to start, in fact point the configuration to any cert and maria fails to start

45

Hopefully someone might investigate whats going on.

46

I think the original problem in this thread has been solved and the conversation has moved on to some other (related, but different) topic. Can you start a new topic for the new problem?

47

Ok I’m not worried about maria ssl on Ubuntu not working, @stefan1959 brought up the point that this configuration worked on other distro’s. TBF I would rather use mysql over maria, have had more database problems, since I switched to VM7 install (maria), than over the previous decade with VM6 & smaller. so therefore I wont be opening another thread on something I have no interest in

48

The issue is that older MariaDB versions are quite capricious about the private key.

If you look at MariaDB log on Ubuntu 20.04 at /var/log/mysql/error.log you’d see:

2023-04-28 18:25:16 0 [Note] InnoDB: Buffer pool(s) load completed at 230428 18:25:16
SSL error: Unable to get private key from '/etc/mysql/mysql-ssl.key'
2023-04-28 18:25:16 0 [ERROR] Failed to setup SSL
2023-04-28 18:25:16 0 [ERROR] SSL error: Unable to get private key
2023-04-28 18:25:16 0 [ERROR] Aborting

The fix for this problem is as simple as:

  1. Editing /etc/mysql/mysql-ssl.key and making a start and end blocks look like this:

    -----BEGIN RSA PRIVATE KEY-----
-----END RSA PRIVATE KEY-----

  2. Run the following command:

    openssl rsa -in /etc/mysql/mysql-ssl.key -out /etc/mysql/mysql-ssl.key

  3. Restart MariaDB with the following command:

    systemctl restart mariadb

@Jamie, we need to consider older systems too, as this issue happens in Ubuntu 20.04 and doesn’t happen in Ubuntu 22.04


1 Like
49

@Ilia what lines in mysql-ssl.key is MariaDB not accepting?

50

It’s about key format, I think!

51

Right, but what is wrong with the original format that you corrected in the comment above?

52

@Jamie, there is nothing wrong with it technically, it’s just that older versions of MySQL/MariaDB don’t understand a newer PKCS#8 format and expect PKCS#1 instead.

Using RSA in START and END blocks signals to a newer versions of openssl that the key should be stored (on re-save) in the old PKCS#1 format, rather than default PKCS#8.

53

Ah, so maybe we can do that conversion in Webmin. But which versions of MySQL are too old? I’m surprised to see that Ubuntu 20.04 is has such an old version


54

I’m also surprised. Also, I cannot answer the question about which are considered to be too old.

Perhaps, we could just run such conversion for all MySQL and MariaDB versions? It appears to work for both new and old versions.

55

@Ilia now certain are you that PKCS 8 vs 1 is the issue? Because I used a test Ubuntu 20 system and copied a cert to MySQL, which I verified was in PKCS 8 format, and it was loaded just fine.

56

for sure it doesn’t work 
 I ‘fixed’ this issue by upgrading maria to v10.6.12

57

@Jamie, does your Ubuntu 22.04 have MariaDB installed or MySQL? The problem happens with a shipped version of MariaDB 10.3.38.

58

It’s running MySQL version 8.0.32-0ubuntu0.20.04.2 , which is what Virtualmin installs by default (or at least, it did when I setup that system).

59

I checked in this fix to convert the key to PKCS1 for copying to MySQL : Convert SSL private key to PKCS1 for MySQL · virtualmin/virtualmin-gpl@6aa3d6f · GitHub

1 Like
60

That patch fixes the problem! Thanks!