Pymysql cannot connect to SSL

I am trying to connect to a MySQL database using python, but I am getting a strange error. This is compounded by the fact that I can use the same connection values ​​from the mysql console command and connect without problems.

Here is the exact code I'm using:

import pymysql from import agentCheck checks

 class DelayedJobCheck(AgentCheck): def check(self, instance): self.log.info("testing connection") self.log.info(instance) connection = pymysql.connect(**instance) cur = cnx.cursor(buffered=True) cur.execute("SHOW STATUS LIKE 'Ssl_cipher'") print(cur.fetchone()) cur.close() cnx.close() self.gauge('hello.world', 1) 

This is the error I get:

  Traceback (most recent call last):
   File "/opt/datadog-agent/agent/checks/__init__.py", line 661, in run
     self.check (copy.deepcopy (instance))
   File "/opt/datadog-agent/agent/checks.d/delayed_job.py", line 10, in check
     connection = pymysql.connect (** instance)
   File "/opt/datadog-agent/embedded/lib/python2.7/site-packages/pymysql/__init__.py", line 88, in Connect
     return Connection (* args, ** kwargs)
   File "/opt/datadog-agent/embedded/lib/python2.7/site-packages/pymysql/connections.py", line 644, in __init__
     self._connect ()
   File "/opt/datadog-agent/embedded/lib/python2.7/site-packages/pymysql/connections.py", line 869, in _connect
     raise exc
 OperationalError: (2003, u "Can't connect to MySQL server on '192.168.199.86' ([SSL: SSL_NEGATIVE_LENGTH] dh key too small (_ssl.c: 590))"))

I run this code in an Ubuntu field, and although initially, it is possible because SSL CA is a self-generated certificate. So I followed the steps here. But that didn't make any difference. I also verified that the process executing this code has full access to the certificate files.

Any ideas what else could cause this?

+6
source share
1 answer

Since the error information says that the dh key is too small, a larger one can help. Replace the default dh512.pem file with dh4096.pem

sudo wget "https://git.openssl.org/gitweb/?p=openssl.git;a=blob_plain;f=apps/dh4096.pem" -O dh4096.pem

Link: http://www.alexrhino.net/jekyll/update/2015/07/14/dh-params-test-fail.html

0
source

All Articles