SSL Connection issue while connecting to mysql database about docker-archiva

[tkent]

👋 @Swarup44 sorry for the slow reply!

Unfortunately, your report doesn't include enough information for me to tell you what's happening and TLS configuration issues can be tricky to debug. That said, I can say a little bit that should be helpful:

1. TLS connections with MySQL definitely work with the current image, when configured correctly (example below).
2. It's likely that you're encountering a TLS version mismatch or other configuration issue.

It's worth pointing out that modern MySQL servers prefer TLSv1.3 in a configuration
that doesn't seem to work with the Java 8 JVM used in the Archiva v2.2.9 image. (I didn't bother trying to figure out what the issue was in my tests, I just switched to TLSv1.2, which worked without any further configuration)

To see TLS (or SSL) connections working with the current image, you can use the following test on a *nix system, provided you have docker + certstrap installed.

#
# Bootstrap a CA with certstrap. Use empty passphrases for this test.
#
certstrap init --common-name ArchivaTestAuth
certstrap request-cert --common-name MySQLDbTest
certstrap sign MySQLDbTest --CA ArchivaTestAuth

#
# Setup a mysql instance with SSL
#
mkdir -p mysql-certs
mv out/MySQLDbTest* mysql-certs/
mv mysql-certs/MySQLDbTest.key mysql-certs/server-key.pem
mv mysql-certs/MySQLDbTest.crt mysql-certs/server-crt.pem

#
# Create a docker network for the test
#
docker network create archivassltest

#
# Start a MySQL instance locally with TLS. 
# Note that TLSv1.2 is explicitly set.
#
docker run -d --rm --name "mysql-test" \
  --net=archivassltest \
  -v ${PWD}/mysql-certs:/etc/ssl/mysql \
  -e MYSQL_ROOT_PASSWORD=example \
  -e MYSQL_DATABASE=archiva \
  -e MYSQL_USER=archiva \
  -e MYSQL_PASSWORD=archiva \
  -p 3306:3306 \
  mysql:8 \
  --ssl-cert=/etc/ssl/mysql/server-crt.pem\
  --ssl-key=/etc/ssl/mysql/server-key.pem \
  --tls-version=TLSv1.2

#
# Setup the CA certs for this test
# 
mkdir -p archiva-ca-certs
cp out/ArchivaTestAuth.crt archiva-ca-certs/

#
# Run archiva, using MySQL, the test CA cert, and requiring SSL. Note, the directive
# to both require SSL and verify the cert in the JDBC driver docs is sslMode=VERIFY_CA
#
# Archiva will be on port 8080
#
docker run --rm -d --name archiva \
  --net=archivassltest \
  -e DB_TYPE=mysql \
  -e DB_USER=archiva \
  -e DB_PASSWORD=archiva \
  -e DB_HOST=mysql-test \
  -e DB_PORT=3306 \
  -e DB_NAME=archiva \
  -v ${PWD}/archiva-ca-certs:/certs \
  -e 'MYSQL_JDBC_PARAMS=sslMode=VERIFY_CA' \
  -p 8080:8080 \
  xetusoss/archiva:v2.2.9

Once, you've verified it works, you can tear it down with

docker stop archiva
docker stop mysql-test
docker network remove archivassltest
rm -rf mysql-certs
rm -rf out