How to fix EE_SSL_ERROR (60): SSL error in MySQL

Connect to your MySQL server and check if SSL support is enabled:

SHOW VARIABLES LIKE 'have_ssl';

The result should show "YES" for the value. If it shows "NO", SSL is not compiled into your MySQL installation and you'll need to rebuild MySQL with SSL support or use a pre-built version that includes it.

MySQL needs read access to the SSL certificate files. Verify permissions on the server:

ls -la /path/to/mysql/ssl/

Certificates should be readable by the MySQL user (typically "mysql" or "mysqld"). Set proper permissions:

chmod 644 /path/to/mysql/ssl/ca-cert.pem
chmod 644 /path/to/mysql/ssl/server-cert.pem
chmod 600 /path/to/mysql/ssl/server-key.pem
chown mysql:mysql /path/to/mysql/ssl/*

Private keys must be readable only by the MySQL user (600 permissions).

Test that your certificates are properly signed and valid:

openssl verify -CAfile ca-cert.pem server-cert.pem

If using client certificates, also verify:

openssl verify -CAfile ca-cert.pem client-cert.pem

Both commands should return "OK". If you see certificate validation errors, your certificates may be self-signed improperly or missing the complete certificate chain.

If using certificates from a certificate authority (like Let's Encrypt), ensure you have the complete chain. The CA certificate file should contain all intermediate certificates in the chain:

cat intermediate-ca.pem root-ca.pem > ca-chain.pem

When connecting with clients, point to the complete chain file. For self-signed certificates, ensure the single CA certificate is used consistently on both client and server.

For MySQL 8.0.16 and later, reload certificates and keys without restarting the server:

ALTER INSTANCE RELOAD TLS;

This command refreshes the SSL configuration in-place. For older MySQL versions, you must restart mysqld:

sudo systemctl restart mysql

Or on systems using service:

sudo service mysql restart

When connecting from a client, ensure the SSL mode and certificate paths match the server configuration:

mysql --ssl-mode=REQUIRED \\
  --ssl-ca=/path/to/ca-cert.pem \\
  --ssl-cert=/path/to/client-cert.pem \\
  --ssl-key=/path/to/client-key.pem \\
  -h mysql-server.example.com -u username -p

For applications, configure the connection string or connection options accordingly. The --ssl-mode can be:
- REQUIRED: Connection must use SSL
- VERIFY_CA: SSL required, verify server CA
- VERIFY_IDENTITY: SSL required, verify CA and hostname match

SSL/TLS certificate validation includes timestamp checks. Ensure both client and server systems have synchronized clocks:

date
timedatectl status  # On systemd systems

If clocks are out of sync, synchronize them using NTP:

sudo timedatectl set-ntp true  # On systemd
sudo ntpq -p  # Check NTP status

Certificates become invalid if the server time is before the certificate's "not before" date or after the "not after" date.