How to fix CR_SERVER_HANDSHAKE_ERR (2012): Error in server handshake in MySQL

Check the versions of both your MySQL client and server to identify compatibility issues:

# Check client version
mysql --version

# Check server version
mysql -h your-host -u your-user -p -e "SELECT VERSION();"

If there's a significant version gap (e.g., MySQL 8.0 client connecting to MySQL 5.5 server), this is likely the root cause. Consider upgrading the older component or using a client version that matches the server.

Identify which authentication plugin the server is using and whether your client supports it:

-- Check default authentication plugin
SELECT @@default_authentication_plugin;

-- Check authentication plugin for your user
SELECT user, host, plugin FROM mysql.user WHERE user = 'your_username';

If the server uses caching_sha2_password or sha256_password but your client only supports mysql_native_password, you'll need to either update the client or change the user's authentication method:

ALTER USER 'your_username'@'your_host' IDENTIFIED WITH mysql_native_password BY 'your_password';
FLUSH PRIVILEGES;

If you're using SSL/TLS, temporarily disable it to determine if certificate issues are causing the handshake failure:

# Connect without SSL
mysql -h your-host -u your-user -p --skip-ssl

# Or specify to disable SSL explicitly
mysql -h your-host -u your-user -p --ssl-mode=DISABLED

If this works, the issue is SSL-related. Verify your SSL certificates, check certificate expiration dates, and ensure the client trusts the server's CA certificate.

Verify that network devices are not interfering with MySQL handshake packets:

# Test basic connectivity to MySQL port (default 3306)
telnet your-host 3306

# Or using nc
nc -zv your-host 3306

# Check for packet filtering
tcpdump -i any -n port 3306

Ensure your firewall allows bidirectional communication on the MySQL port, not just initial connection attempts. Some firewalls or proxies can corrupt protocol negotiation packets.

If using MySQL connectors in your application, update to the latest version that supports the server's authentication methods:

# For Python (MySQLdb/PyMySQL)
pip install --upgrade mysqlclient
# or
pip install --upgrade PyMySQL

# For Node.js
npm update mysql2

# For PHP, check php.ini for mysql extension version
php -i | grep mysql

Restart your application after updating client libraries to ensure the new versions are loaded.

If you've made configuration changes to the server's authentication settings, restart it to apply them:

# On systemd-based systems
sudo systemctl restart mysql

# On older systems
sudo service mysql restart

# Or using mysqladmin
mysqladmin -u root -p shutdown
mysqld_safe &

After restarting, verify the server is listening and attempt the connection again.