Skip to content

Support requiring SSL, and verifying CA, for MySQL#703

Open
MatthiasKunnen wants to merge 1 commit into
amacneil:mainfrom
MatthiasKunnen:mysql-ca-ssl
Open

Support requiring SSL, and verifying CA, for MySQL#703
MatthiasKunnen wants to merge 1 commit into
amacneil:mainfrom
MatthiasKunnen:mysql-ca-ssl

Conversation

@MatthiasKunnen
Copy link
Copy Markdown

@MatthiasKunnen MatthiasKunnen commented Nov 15, 2025

This PR adds support for requiring a secure connection and man-in-the-middle protection in the form of the DBMATE_MYSQL_SSL_MODE and DBMATE_MYSQL_CA_PATH parameter.

This PR will also fix tests failing on the main branch due to certificate verification problems.

Important caveat, the CLI parameter --ssl-mode used for mysqldump is not present in mariadb dump. If there is a way to detect whether mariadb-dump is used, I could change the parameters accordingly but there does not seem to be a distinction at the moment. Suggestions welcome.

I'll refrain from further work until there is some feedback on the approach and whether there is interest in this change.

Todo:

  • Decide how to handle mariadb dump compatibility
  • Add documentation

@dossy dossy added go Pull requests that update Go code needs review labels Feb 11, 2026
@dossy
Copy link
Copy Markdown
Collaborator

dossy commented Feb 11, 2026

The change in #730 addresses very basic SSL on/off control for dbmate with MySQL and MariaDB. No support for CA certificates was implemented there.

Personally, my opinion is rather than trying to shoehorn a menagerie of configuration knobs onto dbmate, it would be far more useful to add a general-purpose "extra args" value that can be specified that is passed through to the underlying dump executable, then the dbmate user has full control now and in the future without additional changes to dbmate itself.

@dossy
Copy link
Copy Markdown
Collaborator

dossy commented Feb 11, 2026

Also: it would be nice to better support CA certificate handling for SSL/TLS connections for all our drivers, not just MySQL. What I mean is, I would prefer a solution that was generalized at the interface level, and each driver implements the necessary mechanism to provide the functionality.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

go Pull requests that update Go code needs review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants