Bug 601394

Summary: [RHEL5] mysql fails to support chained SSL certificates
Product: Red Hat Enterprise Linux 5 Reporter: Bryan Mason <bmason>
Component: mysqlAssignee: Tom Lane <tgl>
Status: CLOSED NEXTRELEASE QA Contact: qe-baseos-daemons
Severity: medium Docs Contact:
Priority: medium    
Version: 5.5CC: azelinka, byte, hhorak, tao, tgl
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 598656 Environment:
Last Closed: 2011-10-17 08:40:01 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Bryan Mason 2010-06-07 20:50:49 UTC 
+++ This bug was initially created as a clone of Bug #598656 +++

Description of problem:
mysql will only read the first certificate from a server or client SSL certificate file.  This fails to support standard arrangements for using chained certificates (ie, those signed by an intermediate certificate authority rather than directly by a root authority).  It is possible to work around this by listing the intermediate authorities as fully trusted in the ssl-ca file, but that's not the recommended way to do things.  The intermediate authorities' certs ought to be appended to the certificate file, instead.

Version-Release number of selected component (if applicable):
mysql-5.1.47-1

Additional info:
See IT 939373 and discussion at
http://post-office.corp.redhat.com/archives/tech-list/2010-May/msg00506.html

--- Additional comment from tgl on 2010-06-01 16:12:36 EDT ---

Filed upstream at http://bugs.mysql.com/bug.php?id=54158
Comment 4 RHEL Program Management 2010-08-09 19:21:35 UTC 
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated in the
current release, Red Hat is unfortunately unable to address this
request at this time. Red Hat invites you to ask your support
representative to propose this request, if appropriate and relevant,
in the next release of Red Hat Enterprise Linux.
Comment 6 RHEL Program Management 2011-05-31 14:43:12 UTC 
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated in the
current release, Red Hat is unfortunately unable to address this
request at this time. Red Hat invites you to ask your support
representative to propose this request, if appropriate and relevant,
in the next release of Red Hat Enterprise Linux.
Comment 7 RHEL Program Management 2011-09-23 00:37:29 UTC 
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated in the
current release, Red Hat is unfortunately unable to address this
request at this time. Red Hat invites you to ask your support
representative to propose this request, if appropriate and relevant,
in the next release of Red Hat Enterprise Linux.