SSL Certification Error > hostname doesn't match

Question

I'm trying to connect to Google Cloud MYSQL server using SSL certificates and the python module PyMySQL with the following line:

connection = pymysql.connect(host=os.environ['SQL_HOST_IP'], user=os.environ['SQL_USER'], password = os.environ['SQL_PASSWORD'],
db='main', charset='utf8mb4', cursorclass=pymysql.cursors.DictCursor, 
ssl={'key': 'client-key.pem', 'cert': 'client-cert.pem', 'ca': 'server-ca.pem'})

Unfortunately, I keep getting the following error:

ssl.CertificateError: hostname 'SQL_IP_ADDRESS' doesn't match '$ALIAS_FROM_SELF_SIGNED_SSL_CERT'

I've lookup up the issue, but can't find a fix that doesn't involve monkeypatching the ssl code to skip ssl verification. I explicitly list the IP address of the SQL Host but the ssl verification halts during ssl.match_hostname because the ssl certs are self-signed with a different host name.

I'm certain that my keys are valid, since I can connect with them using Ruby (Windows/Linux) and a linux mysql CLI. It seems to be an issue with ssl.match_hostname. It's similar to this question and this one but both sidestep the issue.

Is there a way to correctly handle self-signed SSL certs in Python.

Rep

I'm having the exact same problem, have you resolved it? – Jobi

@Rep if you were able to solve this issue it is recommended to post your answer as the solution to better help the community. If not, this issue is usually caused by being behind a firewall or proxy. It is recommended to investigate any local networking configurations and test connecting from a different network that is not restricted in any way. – Alfons

Answer 1

Although the solution to your answer problem was denied as a merge request here: https://github.com/PyMySQL/PyMySQL/pull/555

You have the option to disable check_hostname. This works in version '0.7.11'

ssl_options = {
    'key': 'client-key.pem',
    'cert': 'client-cert.pem',
    'ca': 'server-ca.pem',
    'check_hostname': False
}

connection = pymysql.connect(
    host=os.environ['SQL_HOST_IP'],
    user=os.environ['SQL_USER'],
    password = os.environ['SQL_PASSWORD'],
    db='main', 
    charset='utf8mb4', 
    cursorclass=pymysql.cursors.DictCursor, 
    ssl=ssl_options
)

Design