Verify host identity on replication slave with self-signed certs - amazon-web-services

Question

MySQL 5.7 Ubuntu 16.04 on AWS EC2
I've got replication set up over ssl using self-signed certificates. I am able to connect to the master from the slave using the mysql client with ssl-mode=VERIFY_IDENTITY. The replication is also working over ssl until I try and enable MASTER_SSL_VERIFY_SERVER_CERT to enable host name verification.
With that enabled the slave is no longer able to authenticate with the master and received io error 2026, which is just a generic ssl connection failed error. The logs are not any more helpful nor is ssldump which just shows the connection being aborted before the handshake even starts.
According to the docs:
To activate host name identity verification, add the
MASTER_SSL_VERIFY_SERVER_CERT option.
and
For a replication connection, specifying
MASTER_SSL_VERIFY_SERVER_CERT=1 corresponds to setting
--ssl-mode=VERIFY_IDENTITY
But also
Host name identity verification does not work with self-signed
certificates.
https://dev.mysql.com/doc/refman/5.7/en/replication-solutions-encrypted-connections.html
So how can I enable host name verification during replication with self-signed certificates? The docs seem to indicate it is impossible, but then why am I able to connect via the client with ssl-mode=VERIFY_IDENTITY?
Thank you.

Answer 1

The solution was to add MASTER_SSL_CA, MASTER_SSL_CERT, and MASTER_SSL_KEY to my CHANGE MASTER TO statement to manually point to the ca, cert, and key rather an trusting mysql to read them from the config.
As far as I can tell this means the mysql docs are wrong.
They state that the paths can be set in the [client] section of my.cnf, but this is clearly not the case, at least for me. For whatever reason the [client] section does appear to be used by the mysql client, but is ignored for replication.
I believe I was also misunderstanding self-signed certificates. MASTER_SSL_VERIFY_SERVER_CERT does work because I don't actually have self-signed certs, I have certs signed by my own CA. The CA cert itself is self-signed but that's different from the master/slave certs being self-signed it seems.
And finally, I was absolutely misunderstanding the purpose of MASTER_SSL_VERIFY_SERVER_CERT. It turns out I don't really need it at all because my personal CA only signs certs for this one domain anyway so there's nothing to be gained by checking that the common name of the server cert matches the requested domain. It always will. The verification would only be helpful when using a trusted certificate authority that signs certs for many domains. Then you would want to verify the certificate belongs to the domain you requested otherwise you would be vulnerable to man-in-the-middle attacks.
Hopefully that mess of info helps someone else.