fix: MySQL 5.7 SSL error with auto-detected client#224
Merged
AaronFeledy merged 8 commits intomainfrom Feb 20, 2026
Merged
Conversation
Reproduces #167 - MySQL 8.0 client connecting to MySQL 5.7 server fails with TLS/SSL self-signed certificate error because the MySQL client install script does not configure ssl-mode.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
✅ Deploy Preview for lando-php ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
…SL error The original cli-based test passed because the SSL issue manifests specifically when mysql commands run via services.run or events on an appserver (apache/nginx), matching the real-world Backdrop recipe scenario reported by the user.
This comment has been minimized.
This comment has been minimized.
Prevents TLS/SSL errors when MySQL 8.0 client connects to older MySQL servers (e.g. 5.7) with self-signed certificates. Containers on the same Docker network don't need encrypted connections. Fixes lando/lando#3833
|
Bugbot Autofix prepared fixes for 1 of the 1 bugs found in the latest run.
Or push these changes by commenting: Preview (f8c39f0257)diff --git a/scripts/mysql-client-install.sh b/scripts/mysql-client-install.sh
--- a/scripts/mysql-client-install.sh
+++ b/scripts/mysql-client-install.sh
@@ -50,15 +50,10 @@
cat > /etc/mysql/conf.d/lando.cnf << 'MYCNF'
[client]
default-character-set=utf8mb4
-# Disable SSL verification for local dev — containers on the same Docker
-# network don't need encrypted connections, and older MySQL versions
-# (e.g. 5.7) use self-signed certs that cause verification failures
-ssl-mode=DISABLED
[mysqldump]
# Prevent column-statistics errors with newer mysqldump
skip-column-statistics
-ssl-mode=DISABLED
MYCNF
if ! mysql --version 2>/dev/null; then |
When users set 'database: mysql' without a version (e.g. in Backdrop recipe config), the service type is 'backdrop-mysql' with no colon or version number. The detection regex required a version, so it returned null and no MySQL client was installed — falling back to the default MariaDB client which fails with TLS/SSL errors on MySQL servers. Now matches versionless types and defaults to mysql:8.0 / mariadb:11.4. Fixes lando/lando#3833
PREFERRED still uses SSL when available but won't fail on self-signed certs. DISABLED was too aggressive — it would break connections to servers requiring secure transport.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When
db_client: autodetects MySQL 5.7, it installs the MySQL 8.0 client. The 8.0 client enforces SSL verification by default, but MySQL 5.7 uses self-signed certificates, causing:Reported in lando/lando#3833 by @yorkshire-pudding.
Test
Added
examples/db-client-mysql57to reproduce the failure — PHP 8.4 + MySQL 5.7 with auto-detected client, verifying mysql/mysqldump connectivity.Fix
TBD — likely adding
ssl-mode=PREFERREDto the MySQL client config inmysql-client-install.sh.Note
Medium Risk
Changes default MySQL client SSL behavior globally and adjusts DB service type parsing, which could affect connectivity/security expectations across projects if assumptions differ.
Overview
Fixes MySQL 5.7 connection failures when
db_client: autoinstalls a MySQL 8.x client by writingssl-mode=PREFERREDinto the generated MySQL client config (scripts/mysql-client-install.sh) so self-signed chains don’t hard-fail.Improves database type/version auto-detection in
builders/php.jsto recognizemysql/mariadbservice types with or without explicit versions (and recipe-prefixed variants), applying sensible default versions when omitted.Adds a new
examples/db-client-mysql57leia test (and wires it into the PR workflow matrix) to reproduce/guard against the MySQL 5.7 SSL error scenario using an Apache appserver andservices.runmysql commands.Written by Cursor Bugbot for commit b9d18d6. This will update automatically on new commits. Configure here.