Cannot TLS connect to GCP Cloud SQL(MySQL) using python3

Question

import ssl

sc = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
sc.load_verify_locations(cafile='./server-ca.pem')
sc.load_cert_chain(certfile='./client-cert.pem', keyfile='./client-key.pem')

#sc.check_hostname = False

async with aiomysql.create_pool(
    host=host,
    port=port,
    user=user,
    password=password,
    db=db,
    ssl=sc
)

I'm getting an error like this.

ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: IP address mismatch, certificate is not valid for 'ip_address'. (_ssl.c:1108)

server-ca.pem, client-cert.pem, and client-key.pem are exported from the connection tab of GCP Cloud SQL.

#mysql --ssl-ca=./server-ca.pem --ssl-cert=./client-cert.pem --ssl-key=./client-key.pem --host=host --user=user --password

This mysql command can be used to access.

I would like you to tell me what the problem is.

Cedrik Neumann · Accepted Answer · 2020-04-21 18:06:57Z

3

Just encountered the same problem. You need to set the parameter check_hostname=False, such that SSL doesn't try to verify it.

ssl = {
  'cert': ...,
  'key': ...,
  'ca': ...,
  'check_hostname': False,
}

I'm using PyMySQL. You might look into how that applies to SSLContext in your case.

answered Apr 21, 2020 at 18:06

Cedrik Neumann

1515 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

bobry Over a year ago

Is the security guaranteed even if I change the hostname not to be checked?

Collectives™ on Stack Overflow

Cannot TLS connect to GCP Cloud SQL(MySQL) using python3

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related