[Kea-users] MySQL / TLS Server Validation

[Francis Dupont]

Elton, Norman N writes:
> It appears that newer versions of the Kea docker container are built against
> newer versions of libmariadb. According to ChatGPT, the MariaDB Connector
> library now performs TLS server certificate validation by default. If your
> MySQL server does not support TLS (as verified by SHOW VARIABLES LIKE
> 'as_ssl'), Kea will refuse to start with the error:
>
> TLS/SSL error: SSL is required, but the server does not support it

=> it is a bit more than TLS server certificate verification: it is
requiring TLS.

> The workaround appears to be to start Kea with an environment variable:
>
> MARIADB_TLS_DISABLE_PEER_VERIFICATION=1

=> fine: there is a way to disable TLS. I think you have too a
corresponding knob in the mariadb client config.

> Not sure if there is a Kea configuration knob to do the same?

=> I do not think there is a programmatic way to change this and anyway
it will be not portable. So you have to configure the mariadb client
and expect this will apply to Kea. BTW it is almost the only way to
handle TLS in PostgreSQL.

Thanks

Francis Dupont <fdupont at isc.org>