title: SSL connection error when trying to connect to mysql Aurora via the mysql CLI
body: <p>I will preface by saying I can connect to the DB instance when I'm not trying to go over SSL.</p>
  
  <p>I am following this guide here </p>
  
  <p><a href="http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Aurora.Connect.html" rel="nofollow">http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Aurora.Connect.html</a></p>
  
  <p>I have ensured the db instance is public facing.</p>
  
  <p>The security group of the VPC has the following rules:</p>
  
  <pre><code>Type Protocol Port Range Source
  MySQL/Aurora (3306) TCP (6) 3306 my_ip_address/32
  MySQL/Aurora (3306) TCP (6) 3306 sg-security_group_name
  </code></pre>
  
  <p>Where the security_group_name is the security group for my EC2 cluster.</p>
  
  <p>I am using the cluser endpoint of my aurora cluster. And I've removed the port. I installed mysql on my machine using homebrew. This is the command I am trying from my local machine (macbook):</p>
  
  <pre><code>mysql -h blah-database-cluster.cluster-dfgdgfd.us-east-1.rds.amazonaws.com --ssl-ca=rds-ssl-ca-cert.pem --ssl-verify-server-cert
  </code></pre>
  
  <p>Where rds-ssl-ca-cert.pem is the file I downloaded from here:</p>
  
  <pre><code>http://s3.amazonaws.com/rds-downloads/rds-ssl-ca-cert.pem
  </code></pre>
  
  <p>I get the error:</p>
  
  <pre><code>ERROR 2026 (HY000): SSL connection error: error:00000001:lib(0):func(0):reason(1)
  </code></pre>
  
  <p>I have tried creating a new instance, rebooting etc and no joy. Does my security group need some kind of https rule?</p>
  
  <p>Edit:</p>
  
  <p>Further clue. When I run mysql --ssl locally it doesn't error. But when I do mysql show_variables, it says SSL false and the have_ssl and have_open_ssl variables don't exist. Could this be the problem? I installed the local mysql via homebrew package manager for mac.</p>
  
  <p>New edit:</p>
  
  <p>I re-installed mysql (previously from brew) and now direct from oracle and when I try to connect it <strong>gives a different error - SSL connection error: ASN: bad other signature confirmation</strong></p>