SSL connection error when connecting to RDS MySQL from Django

Question

I'm trying to deploy a Django app on Heroku with an RDS instance as the database backend. Everything is working until I try to encrypt the connection, then I get this error:

OperationalError at /path/
(2026, 'SSL connection error')

Here's the setup:

Standard Django application
MySQL RDS instance with security group allowing connections from all IP addresses
MySQL user is setup to allow connections from any host
Amazon's pem has been downloaded and is specified in Django settings

On Heroku:

DATABASE_URL: mysql2://username:[email protected]:3306/name_staging?sslca=path/to/mysql-ssl-ca-cert.pem

In Django settings:

DATABASES = {
    'default': dj_database_url.config()
}
DATABASES['default']['OPTIONS'] = {'ssl': {'ca': 'mysql-ssl-ca-cert.pem'}}`

I've tried searching and have read a lot about setting this type of environment up in Rails, but the documentation about doing this with Django is light to non-existent.

Has anyone out there successfully deployed a similar setup or does anyone have thoughts on how to solve this error?

Update:

Connecting via cli works as well as connecting directly using MySQLdb in the python interpreter.

Googling around, a common error source appears to be mismatching CNs. Sadly, openssl's s_client doesn't work with mysql, otherwise you could easily debug this... can you connect via the mysql cli? — sk1p
– sk1p, Commented Dec 20, 2013 at 18:23

Jordan Bouvier · Accepted Answer · 2013-12-20 20:15:32Z

9

Solved:

The path to the pem file has to be absolute and you can't use python to attempt to build the absolute path.

DATABASES = {
    'default': dj_database_url.config()
}
DATABASES['default']['OPTIONS'] = {
    'ssl': {'ca': '/app/project_name/rds/mysql-ssl-ca-cert.pem'}
}

Again, detecting the path like this does not work, the path must be hard coded:

DATABASES['default']['OPTIONS'] = {
    'ssl': {'ca': os.path.join(os.path.dirname(__file__), 'rds', 'mysql-ssl-ca-cert.pem')}
}

answered Dec 20, 2013 at 20:15

Jordan Bouvier

3082 silver badges7 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

N V Over a year ago

I'm still getting a 1045 Error - what is this path relative to? The main (root) directory?

Jordan Bouvier Over a year ago

Yes, it needs to be the full path.

Collectives™ on Stack Overflow

SSL connection error when connecting to RDS MySQL from Django

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related