Drush error: TLS/SSL error: SSL is required, but the server does not support it

[jurgenhaas]

I've updated to the latest image for PHP 8.3 this morning and now get the TLS/SSL error: SSL is required, but the server does not support it error when running drush sqlc. When I downgrade the image to the one before, the error goes away.

What's interesting, the PHP-FPM can access the the database with the same credentials without an issue. The mariadb CLI can not and gets the same error message.

Any idea what's wrong here?

EDIT:

• wodby/drupal-php:8.3-4.64.1 works OK
• wodby/drupal-php:8.3 does NOT work and shows the above error

[csandanov]

it seems mariadb client was updated (to 11.4) in the last tag that was built with the new alpine 3.21, the client has server cert verification enabled by default for non local connection https://mariadb.com/kb/en/securing-connections-for-client-and-server/#

wodby/php@21c7268

[jurgenhaas]

Hmm, I've experimented with the MARIADB_CLIENT_SSL_VERIFY_SERVER_CERT env variable, but it doesn't seem to change anything. What's the purpose of that?

[jurgenhaas]

Ah, I see you only committed that a few minutes ago.

Adding that disable-ssl-verify-server-cert manually to the client config. That works for the mariadb cli in the PHP container, but it doesn't work for Drush, unfortunately.

[csandanov]

Does it work if you replace [client-mariadb] with the [client]?

[jurgenhaas]

Unfortunately not. The command drush executes looks like this:

mysql --defaults-file=/tmp/drush_BHJImp --database=drupal --host=mariadb --port=3306 --silent -A < /tmp/drush_JeoAmp

Is the --default-file probably overriding the system conf?

[weitzman]

If you run the drush sql command with --show-passwords option, then it wont use --defaults-file. If that works, lets discuss how to remedy.

[jurgenhaas]

Yes, I've tried that and it works.

[jurgenhaas]

Oh, wait. It seems to work for sqlq but not for sqlc. Doing more testing ...

[jurgenhaas]

Hmm, that seems to be correct as I stated. For sqlq Drush calls mysql and then mariadb, both times by showing the password.

For sqlc Drush calls mysql first by showing the password and then it calls mariadb by using the default file.

[weitzman]

OK, thats a small bug in sqlc. Lets use sqlq to figure out best way forward. Its been a while since I researched merging of [client] config in a my.cnf file. I dunno whats possible with --defaults-file and such. For the Drush history here, see drush-ops/drush#2387 and its linked issues.

[jurgenhaas]

Phew, that's beyond my horizon right now. But I'd be happy to test if anything is around.

[csandanov]

4.65.1 is the tag with disable-ssl-verify-server-cert for mariadb client

[back-2-95]

I can confirm importing a dump with drush sql-query --show-passwords ... worked.