Connecting to CloudSQL Mysql over ssl from external application

Viewed 507

I am trying to get a sample java application to connect to a Mysql gen2 instance I have in GCP. I use SSL and the ip address is whitelisted. I have confirmed connectivity to the instance using the mysql command line and passing in the client-cert.pem, client-key.pem and the server-ca.pem. Now inorder to connect to it from the spring boot java application, I did the following:

  1. created a p12 file from the client cert and key and added it to keystore.jks
  2. created a truststore with the server-ca.pem file.
  3. Added this code in the main before the connection is created:

    System.setProperty("javax.net.debug", "all");
    System.setProperty("javax.net.ssl.trustStore", TRUST_STORE_PATH);
    System.setProperty("javax.net.ssl.trustStorePassword", "fake_password");
    System.setProperty("javax.net.ssl.keyStore", KEY_STORE_PATH);
    System.setProperty("javax.net.ssl.keyStorePassword", "fake_password");
    
  4. For the jdbc url, I used : jdbc:mysql://1.1.1.1:3306/sampledb?useSSL=true&requireSSL=true

However I am unable to connect to the instance and see this error from the java ssl debug:

restartedMain, RECV TLSv1.1 ALERT:  fatal, unknown_ca
%% Invalidated:  [Session-2, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA]
restartedMain, called closeSocket()
restartedMain, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: unknown_ca
restartedMain, called close()
restartedMain, called closeInternal(true)

I also tried to run

openssl verify -CAfile server-ca.pem client-cert.pem`

and got this output:

error 20 at 0 depth lookup:unable to get local issuer certificate`

Any ideas on what I might be doing wrong?

0 Answers
Related