100688 -

The issue is often triggered by how systemd services interact with automatically generated certificate files. When the service restarts, it may recreate or misconfigure the paths to these certificates, leading to a "handshake failure" or validation error.

Users often see errors indicating they "cannot connect to remote mysql-server" despite having correct credentials and network access.

Instead of relying on auto-generated system certificates, use a manually configured Public Key Infrastructure (PKI) to ensure certificates do not change unexpectedly on service restarts. 100688

The code is associated with a specific, long-standing bug in MySQL regarding secure remote connections. The Issue: SSL/TLS Connection Failures

MySQL Bug #100688 identifies a problem where clients are unable to connect to a remote MySQL server when using certain public or CA-signed certificates. This typically occurs because the system fails to correctly validate the certificate chain when the server and client reside on different remote hosts. The issue is often triggered by how systemd

To resolve this connectivity issue, administrators typically need to:

Ensure that the ssl-ca , ssl-cert , and ssl-key variables in the MySQL configuration (e.g., my.cnf ) point to the correct, persistent certificate files. This typically occurs because the system fails to

If the service is regenerating files, use a systemd override to specify exact execution environments that don't interfere with your SSL setup.