How to fix CR_SSL_CONNECTION_ERROR (2026): SSL connection error in MySQL

Connect to your MySQL server and check if SSL is configured:

SHOW VARIABLES LIKE '%ssl%';

You should see have_ssl set to YES. If SSL is not enabled on the server, enable it by adding SSL certificates to your MySQL configuration file (my.cnf or my.ini).

Verify that the SSL certificate files exist and are readable:

ls -l /path/to/ca.pem
ls -l /path/to/server-cert.pem
ls -l /path/to/server-key.pem

Ensure the MySQL server has read permissions on these files. On Linux:

chmod 644 /path/to/ca.pem
chmod 644 /path/to/server-cert.pem
chmod 600 /path/to/server-key.pem

Check the expiration date of your SSL certificates:

openssl x509 -in /path/to/server-cert.pem -noout -dates

If the certificate has expired, generate new ones or renew them from your certificate authority. Update the paths in your MySQL configuration file accordingly.

For Node.js/JavaScript applications using mysql2:

const mysql = require('mysql2');
const fs = require('fs');

const connection = mysql.createConnection({
  host: 'your-host',
  user: 'your-user',
  password: 'your-password',
  ssl: {
    ca: fs.readFileSync('/path/to/ca.pem')
  }
});

For other drivers, ensure you're providing the correct CA certificate path that matches what the server is using.

If using an old client, it may default to TLSv1.0 or TLSv1.1 which modern MySQL servers reject. Force TLS 1.2 or higher in your MySQL configuration (my.cnf):

[mysqld]
tls_version='TLSv1.2,TLSv1.3'

For client connections in Node.js:

ssl: {
  ca: fs.readFileSync('/path/to/ca.pem'),
  minVersion: 'TLSv1.2'
}

If using AWS RDS, download the correct regional certificate from AWS:

wget https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem

Then use it in your connection:

ssl: {
  ca: fs.readFileSync('./global-bundle.pem')
}

If MySQL is compiled with YaSSL and certificates were created with newer OpenSSL, convert to PKCS#1 format:

openssl rsa -in server-key.pem -out server-key-pkcs1.pem

Update my.cnf to use the converted key:

[mysqld]
ssl_key=/path/to/server-key-pkcs1.pem

If client and server certificates share the same common name, regenerate them with different names:

openssl req -x509 -newkey rsa:2048 -keyout server-key.pem -out server-cert.pem -days 365 -nodes -subj '/CN=mysql-server'
openssl req -x509 -newkey rsa:2048 -keyout client-key.pem -out client-cert.pem -days 365 -nodes -subj '/CN=mysql-client'

Update the paths in my.cnf and restart MySQL.

If using an outdated client library, upgrade to the latest version:

For npm packages:

npm update mysql2
# or
npm install --save mysql2@latest

For system packages on Linux:

sudo apt-get install -y mysql-client
# or
sudo yum install -y mysql