How to fix EE_SSL_ERROR (60): SSL error in MySQL

MySQLINTERMEDIATEHIGHUpdated Dec 28, 2025· 117 views

MySQL EE_SSL_ERROR (60) indicates a failed SSL/TLS handshake between client and server. This typically results from certificate validation failures, permission issues, or TLS version mismatches. Fixing it involves verifying certificates, adjusting permissions, and reloading TLS configuration.

Quick fix

Fixes EE_SSL_ERROR (60): SSL error

SHOW VARIABLES LIKE 'have_ssl';
  1. Verify SSL is enabled on the MySQL server
  2. Check SSL certificate and key file permissions
  3. Verify certificate validity with OpenSSL
  4. Ensure complete certificate chain
mysql — error
SHOW VARIABLES LIKE 'have_ssl';
EE_SSL_ERROR (60): SSL error

What this error means

EE_SSL_ERROR (error 60) is a MySQL SSL/TLS handshake failure that occurs when the client and server cannot establish a secure connection. This error was introduced in MySQL 8.0.13 and signals that MySQL's underlying OpenSSL layer detected a certificate, key, or protocol problem serious enough to abort the secure channel. The error indicates that either the server certificate is invalid, expired, or untrusted, or there is a mismatch between client and server TLS configurations.

Typical symptoms

  • MySQL client connections fail with SSL error message
  • Applications cannot connect to MySQL database over SSL/TLS
  • Connection attempts hang or timeout during TLS negotiation
  • Certificate verification fails even with valid certificates
  • Self-signed certificate errors appear in connection logs

Common causes

  1. Server certificate is invalid, expired, or not properly signed by a trusted certificate authority
  2. Client and server TLS version mismatch (e.g., client forcing TLS 1.3 on server without support)
  3. Incorrect file permissions on MySQL SSL certificate and key files (mysqld cannot read them)
  4. Incomplete SSL certificate chain (missing intermediate CA certificates)
  5. Certificate Common Name (CN) mismatch when using VERIFY_IDENTITY mode
  6. Middleboxes or proxies tampering with or terminating TLS packets

How to fix "EE_SSL_ERROR (60): SSL error"

1Verify SSL is enabled on the MySQL server

Connect to your MySQL server and check if SSL support is enabled:

sql
SHOW VARIABLES LIKE 'have_ssl';

The result should show "YES" for the value. If it shows "NO", SSL is not compiled into your MySQL installation and you'll need to rebuild MySQL with SSL support or use a pre-built version that includes it.

2Check SSL certificate and key file permissions

MySQL needs read access to the SSL certificate files. Verify permissions on the server:

bash
ls -la /path/to/mysql/ssl/

Certificates should be readable by the MySQL user (typically "mysql" or "mysqld"). Set proper permissions:

bash
chmod 644 /path/to/mysql/ssl/ca-cert.pem
chmod 644 /path/to/mysql/ssl/server-cert.pem
chmod 600 /path/to/mysql/ssl/server-key.pem
chown mysql:mysql /path/to/mysql/ssl/*

Private keys must be readable only by the MySQL user (600 permissions).

3Verify certificate validity with OpenSSL

Test that your certificates are properly signed and valid:

bash
openssl verify -CAfile ca-cert.pem server-cert.pem

If using client certificates, also verify:

bash
openssl verify -CAfile ca-cert.pem client-cert.pem

Both commands should return "OK". If you see certificate validation errors, your certificates may be self-signed improperly or missing the complete certificate chain.

4Ensure complete certificate chain

If using certificates from a certificate authority (like Let's Encrypt), ensure you have the complete chain. The CA certificate file should contain all intermediate certificates in the chain:

bash
cat intermediate-ca.pem root-ca.pem > ca-chain.pem

When connecting with clients, point to the complete chain file. For self-signed certificates, ensure the single CA certificate is used consistently on both client and server.

5Reload TLS configuration without restart

For MySQL 8.0.16 and later, reload certificates and keys without restarting the server:

sql
ALTER INSTANCE RELOAD TLS;

This command refreshes the SSL configuration in-place. For older MySQL versions, you must restart mysqld:

bash
sudo systemctl restart mysql

Or on systems using service:

bash
sudo service mysql restart
6Configure client SSL mode and options

When connecting from a client, ensure the SSL mode and certificate paths match the server configuration:

bash
mysql --ssl-mode=REQUIRED \\
  --ssl-ca=/path/to/ca-cert.pem \\
  --ssl-cert=/path/to/client-cert.pem \\
  --ssl-key=/path/to/client-key.pem \\
  -h mysql-server.example.com -u username -p

For applications, configure the connection string or connection options accordingly. The --ssl-mode can be:
- REQUIRED: Connection must use SSL
- VERIFY_CA: SSL required, verify server CA
- VERIFY_IDENTITY: SSL required, verify CA and hostname match

7Synchronize system clocks

SSL/TLS certificate validation includes timestamp checks. Ensure both client and server systems have synchronized clocks:

bash
date
timedatectl status  # On systemd systems

If clocks are out of sync, synchronize them using NTP:

bash
sudo timedatectl set-ntp true  # On systemd
sudo ntpq -p  # Check NTP status

Certificates become invalid if the server time is before the certificate's "not before" date or after the "not after" date.

Advanced notes

For Docker or Kubernetes deployments, certificate and key files are often mounted as secrets with root-only permissions. Ensure the MySQL container or pod runs with appropriate permissions or mounts the secrets with readable permissions (e.g., using defaultMode: 0644 in Kubernetes). Load balancers or proxies that intercept TLS require either certificate pass-through mode or matching certificates installed on the proxy layer. For development with self-signed certificates, you can temporarily use --ssl-mode=SKIP_VERIFY (if supported by your client library) or --ssl-mode=DISABLED on the client side, but this exposes credentials in plaintext and should never be used in production. Some MySQL clients have extended key usage (extendedKeyUsage) extension requirements—ensure client certificates specify clientAuth if the CN mismatch still occurs after verifying basic configuration.

Frequently asked questions

What does "EE_SSL_ERROR (60): SSL error" mean?
EE_SSL_ERROR (error 60) is a MySQL SSL/TLS handshake failure that occurs when the client and server cannot establish a secure connection. 13 and signals that MySQL's underlying OpenSSL layer detected a certificate, key, or protocol problem serious enough to abort the secure channel. The error indicates that either the server certificate is invalid, expired, or untrusted, or there is a mismatch between client and server TLS configurations.
How do I fix "EE_SSL_ERROR (60): SSL error"?
MySQL EE_SSL_ERROR (60) indicates a failed SSL/TLS handshake between client and server. This typically results from certificate validation failures, permission issues, or TLS version mismatches. Fixing it involves verifying certificates, adjusting permissions, and reloading TLS configuration.
What causes "EE_SSL_ERROR (60): SSL error"?
Server certificate is invalid, expired, or not properly signed by a trusted certificate authority Client and server TLS version mismatch (e.g., client forcing TLS 1.3 on server without support) Incorrect file permissions on MySQL SSL certificate and key files (mysqld cannot read them)
Is the "EE_SSL_ERROR (60): SSL error" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading