title: Amazon mysql rds refusing to accept credentials after upgrade
body: <p>I have an old RDS database that was on 5.6_MySql_1.23.0, being used by a Java application running:</p>
  <pre class="lang-xml prettyprint-override"><code>        &lt;dependency&gt;
              &lt;groupId&gt;mysql&lt;/groupId&gt;
              &lt;artifactId&gt;mysql-connector-java&lt;/artifactId&gt;
              &lt;version&gt;5.1.47&lt;/version&gt;
              &lt;scope&gt;compile&lt;/scope&gt;
          &lt;/dependency&gt;
  </code></pre>
  <p>I've been refactoring old code, and part of that is upgrading from java 8 to 11. According to <a href="https://stackoverflow.com/questions/67332909/why-can-java-not-connect-to-mysql-5-7-after-the-latest-jdk-update-and-how-should">this post</a> Java 11 doesn't support TLS=v1.0 &amp; v1.1 anymore.</p>
  <p>So I upgraded the cluster instance to 5.6_MySql_1.23.1 which does support TLS=v1.2 And I upgraded mysql connector to:</p>
  <pre class="lang-xml prettyprint-override"><code>       &lt;dependency&gt;
              &lt;groupId&gt;mysql&lt;/groupId&gt;
              &lt;artifactId&gt;mysql-connector-java&lt;/artifactId&gt;
              &lt;version&gt;5.1.49&lt;/version&gt;
              &lt;scope&gt;compile&lt;/scope&gt;
          &lt;/dependency&gt;
  </code></pre>
  <p>Running  <code>SHOW GLOBAL VARIABLES LIKE 'tls_version';</code> seems to return a TLSv1.2 enabled cluster:</p>
  <blockquote>
  <p>TLSv1,TLSv1.1,TLSv1.2</p>
  </blockquote>
  <p>However, since the upgrade my username and password are constantly getting rejected:</p>
  <pre class="lang-sh prettyprint-override"><code>Caused by: java.sql.SQLSyntaxErrorException: Access denied for user 'user'@'%' to database 'dba'
      at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:120)
      at com.mysql.cj.jdbc.exceptions.SQLExceptionsMapping.translateException(SQLExceptionsMapping.java:122)
      at com.mysql.cj.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:828)
      at com.mysql.cj.jdbc.ConnectionImpl.&lt;init&gt;(ConnectionImpl.java:448)
      at com.mysql.cj.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:241)
      at com.mysql.cj.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:198)
      at java.sql/java.sql.DriverManager.getConnection(DriverManager.java:677)
      at java.sql/java.sql.DriverManager.getConnection(DriverManager.java:251)
      at medispan.foundation.dataaccess.providers.sql.SQLProvider.createProviderConnection(SQLProvider.java:227)
      at medispan.foundation.dataaccess.providers.sql.SQLProvider.createConnection(SQLProvider.java:205)
      at medispan.foundation.dataaccess.providers.sql.SQLProvider.openConnection(SQLProvider.java:841)
      at medispan.foundation.dataaccess.providers.sql.SQLProvider.executeForResults(SQLProvider.java:1489)
      at medispan.foundation.dataaccess.providers.sql.SQLDataAccessProvider.innerExecuteForCollection(SQLDataAccessProvider.java:515)
      ... 120 common frames omitted
  </code></pre>
  <p>Here's my JDBC string that worked in my java 8 service:</p>
  <pre><code>jdbc:mysql://test-aurora-sdt-c1-0.cpdk4xuooxvm.us-east-1.rds.amazonaws.com:3306?user=[user]&amp;password=[password]&amp;verifyServerCertificate=false&amp;useSSL=true&amp;sslca=rds-combined-ca-bundle.pem&amp;serverTimezone=PST
  </code></pre>
  <p>Here's my updated url for all the errors I've had to fix with the mysql changes since the two versions:</p>
  <pre><code>jdbc:mysql://test-aurora-sdt-c1-0.cpdk4xuooxvm.us-east-1.rds.amazonaws.com:3306/dba?user=[user]&amp;password=[password]&amp;verifyServerCertificate=false&amp;useSSL=true&amp;enabledTLSProtocols=TLSv1.2&amp;sslca=rds-combined-ca-bundle.pem&amp;serverTimezone=America/Los_Angeles
  </code></pre>
  <p>Did I miss a step database version migration to enable tls? Do I have to do something with my cert bundle that I'm just not aware of coming from a dynamo background?</p>