SSL connect to mysql from django

We just had a migration from a “unsecured” mysql DB to a SSL mysql but my Django application cannot connect anymore.

content of settings.py

DATABASES = {
    "default": {
        "ENGINE": 'django.db.backends.mysql'
        "NAME": env("DATABASE_NAME"),
        "USER": env("DATABASE_USER"),
        "PASSWORD": env("DATABASE_PASSWORD"),
        "HOST": env("DATABASE_HOST"),
        "PORT": env.int("DATABASE_PORT"),
        "CONN_MAX_AGE": env.int("DATABASE_CONN_MAX_AGE", default=0),
    },
    "OPTIONS": {
        "timeout": env.int("DATABASE_CONN_TIMEOUT", default=60),
        "ssl": {
            "ca": CA_ROOT_PATH
        },
    }
}

and when I execute this Django command line : python3 manage.py dbshell (which used to work with the pre-migration DB), I receive the error message :

ERROR 2026 (HY000): SSL connection error: unknown error number
subprocess.CalledProcessError: Command '['mysql', '--user=user', '--password=password', '--host=host', '--port=3306', 'db']' returned non-zero exit status 1.

As you can see, the executed mysql command does not contain anything related to SSL connection.

I tried also to modify the OPTIONS in settings.py with these values :

    "OPTIONS": {
        "timeout": env.int("DATABASE_CONN_TIMEOUT", default=60),
        "ssl": {
            "ssl-ca": CA_ROOT_PATH,
            "ca": CA_ROOT_PATH
        },
        "ssl-ca" : CA_ROOT_PATH,
    }

Still the same output. It does not seem to use the SSL options in any way… Any idea what I should look for ?

Answer

Your “OPTIONS” should probably be inside the “default” connection, now you have two connections “default” and “OPTIONS” instead of having the “OPTIONS” set under the “default” connection. See how it’s done in the possible duplicate Bill linked.