MySQL TLS/SSL error: self-signed certificate in certificate chain #6202

New Issue

GiteaMirror · 2026-03-07T20:54:13-06:00

GiteaMirror commented

2026-03-07 20:54:13 -06:00

Originally created by @adminpass on GitHub (Mar 6, 2026).

Prerequisites

I have searched the existing Closed AND Open Issues AND Discussions
I have searched and read the documentation

Vaultwarden Support String

export DATABASE_URL=mysql://root:pass@10.0.1.11:3306/vaultwarden
export DATABASE_MIN_CONNS=2
export DATABASE_MAX_CONNS=5

and DATABASE_URL=mysql://root:pass@10.0.1.11:3306/vaultwarden?ssl_mode=DISABLED

[2026-03-06 10:00:05.237][vaultwarden::util][WARN] Can't connect to database, retrying: DieselCon.
[CAUSE] BadConnection(
"TLS/SSL error: self-signed certificate in certificate chain",
)

Vaultwarden Build Version

v1.35.4

Deployment method

Official Container Image

Custom deployment method

No response

Reverse Proxy

nginx

Host/Server Operating System

Linux

Operating System Version

alpine 3.24

Clients

Web Vault

Client Version

No response

Steps To Reproduce

↑

Expected Result

mysql TLS/SSL error

Actual Result

mysql TLS/SSL error

Logs

[2026-03-06 10:00:05.237][vaultwarden::util][WARN] Can't connect to database, retrying: DieselCon.
[CAUSE] BadConnection(
    "TLS/SSL error: self-signed certificate in certificate chain",
)

Screenshots or Videos

No response

Additional Context

No response

Originally created by @adminpass on GitHub (Mar 6, 2026). ### Prerequisites - [x] I have searched the existing **Closed _AND_ Open** [Issues](https://github.com/dani-garcia/vaultwarden/issues?q=is%3Aissue%20) **_AND_** [Discussions](https://github.com/dani-garcia/vaultwarden/discussions?discussions_q=) - [x] I have searched and read the [documentation](https://github.com/dani-garcia/vaultwarden/wiki/) ### Vaultwarden Support String ```ini export DATABASE_URL=mysql://root:pass@10.0.1.11:3306/vaultwarden export DATABASE_MIN_CONNS=2 export DATABASE_MAX_CONNS=5 ``` and DATABASE_URL=mysql://root:pass@10.0.1.11:3306/vaultwarden?**ssl_mode=DISABLED** [2026-03-06 10:00:05.237][vaultwarden::util][WARN] Can't connect to database, retrying: DieselCon. [CAUSE] BadConnection( "TLS/SSL error: self-signed certificate in certificate chain", ) ### Vaultwarden Build Version v1.35.4 ### Deployment method Official Container Image ### Custom deployment method _No response_ ### Reverse Proxy nginx ### Host/Server Operating System Linux ### Operating System Version alpine 3.24 ### Clients Web Vault ### Client Version _No response_ ### Steps To Reproduce ↑ ### Expected Result mysql TLS/SSL error ### Actual Result mysql TLS/SSL error ### Logs ```text [2026-03-06 10:00:05.237][vaultwarden::util][WARN] Can't connect to database, retrying: DieselCon. [CAUSE] BadConnection( "TLS/SSL error: self-signed certificate in certificate chain", ) ``` ### Screenshots or Videos _No response_ ### Additional Context _No response_

GiteaMirror added the bug label 2026-03-07 20:54:13 -06:00

GiteaMirror closed this issue

2026-03-07 20:54:13 -06:00

GiteaMirror commented

2026-03-07 20:54:14 -06:00

@stefan0xC commented on GitHub (Mar 6, 2026):

Not a bug but you are missing some configuration. Cf. https://docs.diesel.rs/main/diesel/mysql/struct.MysqlConnection.html#method.establish (and the linked mysql docs) for more information how to configure an encrypted mysql connection.

@stefan0xC commented on GitHub (Mar 6, 2026): Not a bug but you are missing some configuration. Cf. https://docs.diesel.rs/main/diesel/mysql/struct.MysqlConnection.html#method.establish (and the linked mysql docs) for more information how to configure an encrypted mysql connection.

GiteaMirror commented

2026-03-07 20:54:14 -06:00

@adminpass commented on GitHub (Mar 6, 2026):

I found the reason!

Alpine 3.22 -> mariadb-connector-c-3.3.10-r0

Alpine 3.23+ -> mariadb-connector-c-3.4.6-r0

1. Behavior in Version 3.3.x (Old)

Default Logic: If the connection string did not explicitly request SSL, or if ssl_mode=DISABLED was set, the connector would completely bypass SSL, establishing a plain text connection immediately.
Forgiveness: It was highly tolerant. Even if the server supported SSL, the client would not attempt a handshake unless explicitly forced, preventing certificate validation errors in self-hosted environments without valid CA certificates.

2. Behavior in Version 3.4.x (New - Alpine 3.24)

Default Logic Change: To enforce security, version 3.4+ changed the implicit default behavior. Even if you specify ssl_mode=DISABLED in the URL, the underlying C library (especially when called via Rust bindings like mysql_async) may ignore this flag or prioritize a PREFERRED state.
The Consequence:
- The client attempts to initiate an SSL/TLS handshake automatically.
- Since your self-hosted MariaDB likely uses a self-signed certificate or no certificate at all, the handshake fails because the client cannot verify the server's identity.
- Result: You see errors like:
  - error: "Peer certificate cannot be authenticated with given CA certificates"
  - error: "TLS/SSL connection required but not configured"
  - error: "SSL connection error: unknown error number"

@adminpass commented on GitHub (Mar 6, 2026): I found the reason! Alpine 3.22 -> **mariadb-connector-c-3.3.10-r0** Alpine 3.23+ -> **mariadb-connector-c-3.4.6-r0** ### 1. Behavior in Version 3.3.x (Old) - Default Logic: If the connection string did not explicitly request SSL, or if ssl_mode=DISABLED was set, the connector would completely bypass SSL, establishing a plain text connection immediately. - Forgiveness: It was highly tolerant. Even if the server supported SSL, the client would not attempt a handshake unless explicitly forced, preventing certificate validation errors in self-hosted environments without valid CA certificates. ### 2. Behavior in Version 3.4.x (New - Alpine 3.24) - Default Logic Change: To enforce security, version 3.4+ changed the implicit default behavior. Even if you specify ssl_mode=DISABLED in the URL, the underlying C library (especially when called via Rust bindings like mysql_async) may ignore this flag or prioritize a PREFERRED state. - The Consequence: - The client attempts to initiate an SSL/TLS handshake automatically. - Since your self-hosted MariaDB likely uses a self-signed certificate or no certificate at all, the handshake fails because the client cannot verify the server's identity. - Result: You see errors like: - error: "Peer certificate cannot be authenticated with given CA certificates" - error: "TLS/SSL connection required but not configured" - error: "SSL connection error: unknown error number"

GiteaMirror referenced this issue

2026-03-07 21:16:32 -06:00

[PR #6202] feat: Add comprehensive Prometheus metrics support #7379

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#6202