Cannot connect to php contatiner to mysql: ERROR 2026 (HY000): TLS/SSL error: self-signed certificate in certificate chain

Docker Engine General
1

With the docker composer below I cannot conect to my mysql container from my php
container. I get error:

ERROR 2026 (HY000): TLS/SSL error: self-signed certificate in certificate chain

The mysql container works form my host:

docker exec -it my_project_mysql bash -c "mysql -u root -proot"

But not from the php container

docker exec --privileged -it   my_project_php  bash
5f47b4b8b4c7:/var/www# 
5f47b4b8b4c7:/var/www# mysql -h my_project_mysql
ERROR 2026 (HY000): TLS/SSL error: self-signed certificate in certificate chain

My docker.yml:

services:

 ####################################################################################################
    # PHP
    ####################################################################################################
    php:
        container_name: my_project_php
        build: .docker/php
        ports:
            - 5173:5173
        volumes:
            - .:/var/www:cached

        extra_hosts:
            - "host.docker.internal:host-gateway"

    ####################################################################################################
    # Nginx
    ####################################################################################################
    nginx:
        container_name: my_project_nginx
        image: nginx
        ports:
            - 8000:80
        volumes:
            - .:/var/www
            - .docker/nginx/default.conf:/etc/nginx/conf.d/default.conf
            - .docker/nginx/nginx.conf:/etc/nginx/nginx.conf
            - .docker/nginx/certs:/etc/nginx/ssl
        depends_on:
            - php

    ####################################################################################################
    # DATABASE (MySQL)
    # docker exec -it my_project_mysql bash -c "mysql -u root -proot"
    # for a sql client:  mysql -h localhost --protocol=tcp   -uroot -proot
    ####################################################################################################
    my_project_db:
        container_name: my_project_mysql
        image: mysql:8.0
        ports:
            - 3306:3306
        volumes:
            - .docker/db/data:/var/lib/mysql
            - .docker/logs:/var/log/mysql
            - .docker/db/my.cnf:/etc/mysql/conf.d/my.cnf
            - .docker/db/sql:/docker-entrypoint-initdb.d
        environment:
            MYSQL_ROOT_PASSWORD: root
            MYSQL_DATABASE: my_project_db_name
            MYSQL_USER: my_project_db_user
            MYSQL_PASSWORD: my_project_db_pass

I am not an expert and
I have been trouble shooting in the folder:
.docker/db/data/

My assumption is that the certifactions her are not correct, but I don’t know to go further.

2

It seems you are using some kind of certificates. The error is clear: TLS/SSL error: self-signed certificate in certificate chain.

Either you have loaded the wrong TLS certs, self-signed instead of official issued ones. Or you need to import the self-signed certs into PHP container for it to trust them. Or you need to tell PHP to not verify the certs when connecting to DB, if that is an option in the database driver.

But it’s not a dedicated Docker issue.

3

I don1t think the mount you quoted is relevant here, since it is mounted to the nginx container and the PHP container will not need that. That must be the TLS cert to access the site from the webbrowser, which should not affect MySQL connection.

My guess is that there are some settings in my.cnf that enables TLS for the MySQL server but without mounting an actual TLS cert, it uses some kind of self-signed default cert.

@tuulia Have you tried the MySQL server without the custom configuration?

You could also check the MySQL container logs as I suspect the server would show a warning when it uses a self-signed cert.

4

Hi

Thanks

I tried the following but I still get the error.
But is is good to know that is is not a docker problem…
For me it looks like something has been corrupted on my host. This was working fine suddenly when
I started a new project, it does not work any more.

  1. I deleted
    - .docker/nginx/certs:/etc/nginx/ssl
    from docker.yml:
  2. I deleted the file
    .docker/db/my.cnf
    (when I run compose up -d, it is recreated)
  3. I deleted all of the containers and images
  4. I run compose up -d
5

I found a solution, which I can use on my dev server

mysql -hmy_project_mysql --ssl-verify-server-cert=false

Anyway thanks for your help bluepuma77 !