How to fix CR_SSL_CONNECTION_ERROR (2026): SSL connection error in MySQL

MySQLINTERMEDIATEHIGHUpdated Dec 29, 2025· 215 views

MySQL error 2026 occurs when the SSL/TLS connection between client and server fails due to certificate issues, protocol version mismatches, or misconfiguration. This commonly affects database connections in applications and requires SSL certificate verification fixes.

Quick fix

Fixes 2026

SHOW VARIABLES LIKE '%ssl%';
  1. Verify SSL is enabled on the MySQL server
  2. Check certificate paths and permissions
  3. Verify certificates are not expired
  4. Update client SSL configuration with correct CA certificate
mysql — error
SHOW VARIABLES LIKE '%ssl%';
CR_SSL_CONNECTION_ERROR (2026): SSL connection error

What this error means

Error 2026 (CR_SSL_CONNECTION_ERROR) is a MySQL connection error that occurs when the SSL/TLS layer fails to establish a secure connection between your client and the MySQL server. This can happen due to certificate validation failures, protocol version incompatibility, expired certificates, incorrect certificate paths, or mismatched SSL configurations between client and server. The error is thrown by the MySQL client library when it cannot negotiate a secure connection using the provided SSL parameters. This is a critical error because it completely prevents database connections when SSL is required, making it impossible for your application to authenticate and connect to the database.

Typical symptoms

  • Connection attempts fail with 'SSL connection error' message
  • Application cannot establish database connection
  • Error appears immediately when trying to connect to MySQL
  • Works without SSL but fails when SSL is required
  • Error occurs after MySQL or client library upgrades

Common causes

  1. TLS protocol version mismatch (client using TLSv1/TLSv1.1 on modern MySQL that requires TLSv1.2+)
  2. Expired or invalid SSL certificate on the server
  3. Incorrect certificate file path or permissions
  4. Self-signed certificate not trusted by client
  5. Certificate generated with same common name for client and server
  6. Incorrect certificate format (PKCS#1 vs PKCS#8 incompatibility with YaSSL)
  7. Missing or incomplete certificate chain
  8. Firewall blocking port 3306 or SSL traffic
  9. Outdated MySQL client library that does not support server's SSL version

How to fix "CR_SSL_CONNECTION_ERROR (2026): SSL connection error"

1Verify SSL is enabled on the MySQL server

Connect to your MySQL server and check if SSL is configured:

sql
SHOW VARIABLES LIKE '%ssl%';

You should see have_ssl set to YES. If SSL is not enabled on the server, enable it by adding SSL certificates to your MySQL configuration file (my.cnf or my.ini).

2Check certificate paths and permissions

Verify that the SSL certificate files exist and are readable:

bash
ls -l /path/to/ca.pem
ls -l /path/to/server-cert.pem
ls -l /path/to/server-key.pem

Ensure the MySQL server has read permissions on these files. On Linux:

bash
chmod 644 /path/to/ca.pem
chmod 644 /path/to/server-cert.pem
chmod 600 /path/to/server-key.pem
3Verify certificates are not expired

Check the expiration date of your SSL certificates:

bash
openssl x509 -in /path/to/server-cert.pem -noout -dates

If the certificate has expired, generate new ones or renew them from your certificate authority. Update the paths in your MySQL configuration file accordingly.

4Update client SSL configuration with correct CA certificate

For Node.js/JavaScript applications using mysql2:

javascript
const mysql = require('mysql2');
const fs = require('fs');

const connection = mysql.createConnection({
  host: 'your-host',
  user: 'your-user',
  password: 'your-password',
  ssl: {
    ca: fs.readFileSync('/path/to/ca.pem')
  }
});

For other drivers, ensure you're providing the correct CA certificate path that matches what the server is using.

5Ensure compatible TLS protocol versions

If using an old client, it may default to TLSv1.0 or TLSv1.1 which modern MySQL servers reject. Force TLS 1.2 or higher in your MySQL configuration (my.cnf):

ini
[mysqld]
tls_version='TLSv1.2,TLSv1.3'

For client connections in Node.js:

javascript
ssl: {
  ca: fs.readFileSync('/path/to/ca.pem'),
  minVersion: 'TLSv1.2'
}
6For AWS RDS connections, download the correct certificate

If using AWS RDS, download the correct regional certificate from AWS:

bash
wget https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem

Then use it in your connection:

javascript
ssl: {
  ca: fs.readFileSync('./global-bundle.pem')
}
7If YaSSL incompatibility, convert certificate format

If MySQL is compiled with YaSSL and certificates were created with newer OpenSSL, convert to PKCS#1 format:

bash
openssl rsa -in server-key.pem -out server-key-pkcs1.pem

Update my.cnf to use the converted key:

ini
[mysqld]
ssl_key=/path/to/server-key-pkcs1.pem
8Regenerate certificates with different common names

If client and server certificates share the same common name, regenerate them with different names:

bash
openssl req -x509 -newkey rsa:2048 -keyout server-key.pem -out server-cert.pem -days 365 -nodes -subj '/CN=mysql-server'
openssl req -x509 -newkey rsa:2048 -keyout client-key.pem -out client-cert.pem -days 365 -nodes -subj '/CN=mysql-client'

Update the paths in my.cnf and restart MySQL.

9Update MySQL client library

If using an outdated client library, upgrade to the latest version:

For npm packages:

bash
npm update mysql2
# or
npm install --save mysql2@latest

For system packages on Linux:

bash
sudo apt-get install -y mysql-client
# or
sudo yum install -y mysql

Advanced notes

Certificate Format Issues: MySQL versions compiled with YaSSL (older versions or specific builds) require certificates in PKCS#1 format with '-----BEGIN RSA PRIVATE KEY-----' headers. Newer OpenSSL versions generate PKCS#8 format by default. If you see the error after upgrading OpenSSL, convert your private keys to PKCS#1 format.

Subject Alternative Names (SAN): When using cloud databases like AWS RDS, ensure your client supports SAN if you're using cluster endpoints. Older clients must use primary instance endpoints.

Certificate Chain: Some setups require the full certificate chain to be provided. If using intermediate certificates, ensure they're included in the CA bundle.

TLS Version Evolution: MySQL 8.0+ defaults to TLSv1.2 minimum. If your client is stuck on TLSv1.0 or TLSv1.1, upgrade the client library or explicitly allow newer protocols on the server (though this is a security trade-off).

Self-Signed Certificates: For development, you can use self-signed certificates but must either trust them in your client or disable verification with rejectUnauthorized: false (not recommended for production).

Firewall and Network: Even if SSL is configured correctly, firewalls may block port 3306 or interfere with SSL negotiation. Test with openssl s_client -connect host:3306 to verify connectivity.

Frequently asked questions

What does "2026" mean?
Error 2026 (CR_SSL_CONNECTION_ERROR) is a MySQL connection error that occurs when the SSL/TLS layer fails to establish a secure connection between your client and the MySQL server. This can happen due to certificate validation failures, protocol version incompatibility, expired certificates, incorrect certificate paths, or mismatched SSL configurations between client and server. The error is thrown by the MySQL client library when it cannot negotiate a secure connection using the provided SSL parameters.
How do I fix "2026"?
MySQL error 2026 occurs when the SSL/TLS connection between client and server fails due to certificate issues, protocol version mismatches, or misconfiguration. This commonly affects database connections in applications and requires SSL certificate verification fixes.
What causes "2026"?
TLS protocol version mismatch (client using TLSv1/TLSv1.1 on modern MySQL that requires TLSv1.2+) Expired or invalid SSL certificate on the server Incorrect certificate file path or permissions
Is the "2026" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading