# Using ssl in community.mysql when ssl is required

**URL:** <https://forum.ansible.com/t/using-ssl-in-community-mysql-when-ssl-is-required/41032>\
**Category:** Get Help\
**Created:** [March 13, 2025, 3:59pm UTC](https://forum.ansible.com/t/using-ssl-in-community-mysql-when-ssl-is-required/41032 "2025-03-13T15:59:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jdanilson1](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jdanilson1/32/7892_2.png) [@jdanilson1](https://forum.ansible.com/u/jdanilson1)\
**Post date:** [March 13, 2025, 3:59pm UTC](https://forum.ansible.com/t/using-ssl-in-community-mysql-when-ssl-is-required/41032/1 "2025-03-13T15:59:09Z")

</div>

Our mysql complex requires ssl connection, e.g., the mysql instance specifies require\_secure\_transport=ON

using this ansible script (not all is shown)

- name: query for variable settings  
community.mysql.mysql\_info:  
login\_user: “{{ root\_user }}”  
login\_password: “{{ root\_pwd }}”  
connect\_timeout: 5  
filter:  
- settings  
register: mstatus

I get connected without issue if I disable require\_secure\_transport

But if it remains enabled on the server and I include these entries:  
ssl\_ca: /dsb/mysql/etc/certs/ca.pem  
ssl\_cert: /dsb/mysql/etc/certs/server-cert.pem

and attempt to connect I get:  
unable to connect to database, check login\_user and login\_password are correct or /home/mysql/.my.cnf has the credentials. Exception message: [SSL] PEM lib (\_ssl.c:3938)

we know the user/password is correct.  
so the assumption is it is rejecting or not using our ca and key. Could this be because the ca is self-signed.

We are running version 1.0.0.

if not due to self signed, is there a way to find the error 3938 to understand the error in more detail?

---

<div class="post-metadata">

**Author:** ![chris](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/chris/32/293_2.png) [@chris](https://forum.ansible.com/u/chris)\
**Post date:** [March 13, 2025, 5:20pm UTC](https://forum.ansible.com/t/using-ssl-in-community-mysql-when-ssl-is-required/41032/2 "2025-03-13T17:20:35Z")

</div>

This is a guess but a socket is usually used by default these days rather than TCP/IP, is this working without the SSL settings and then failing when they are added as the service isn’t available using TCP/IP and SSL won’t be used by a socket?

---

<div class="post-metadata">

**Author:** ![jdanilson1](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jdanilson1/32/7892_2.png) [@jdanilson1](https://forum.ansible.com/u/jdanilson1)\
**Post date:** [March 13, 2025, 7:29pm UTC](https://forum.ansible.com/t/using-ssl-in-community-mysql-when-ssl-is-required/41032/3 "2025-03-13T19:29:35Z")

</div>

Chris,

Thanks for your thoughts. I’ve inherited a library of ansible files that are in a broken state and trying to resurect them.

Meanwhile, in theory, there’s no reason an ssh session to the host using ssl should be needed. This is a standard mysql call on port 3306 using tcp/ip. So I would expect the ca.pem and server\_cert.pem would be sufficient to make the connection. That also is confirmed to work with the mysql client.

So I went ahead and updated community.mysql so I could use check\_hostname: Then I tried using the server\_key.pm in conjunction with check\_hostname: false and that works.

For now this solves my issue but I 'd much rather not have to use an ssh session and then communicate via the socket to mysql.

Clearly the error is indicating it’s unhappy with the pem file for some reason and I’d love to understand what that is.