[mythtv-users] mariadb tsl/ssl

[James Linder]

On Sep 26, 2025, at 16:14, Paul Gardiner via mythtv-users <mythtv-users at mythtv.org> wrote:
> 
> On 26/09/2025 00:41, James Linder via mythtv-users wrote:
>>> On Sep 25, 2025, at 23:07, Paul Gardiner via mythtv-users <mythtv-users at mythtv.org> wrote:
>>> 
>>> On 25/09/2025 13:51, James Linder via mythtv-users wrote:
>>>>> On Sep 24, 2025, at 00:00, Paul Gardiner via mythtv-users <mythtv-users at mythtv.org> wrote:
>>>>> 
>>>>> On 23/09/2025 14:13, James Linder via mythtv-users wrote:
>>>>>> The problem lurks and will bite
>>>>>> maridb in their infinite wisdom (sic) have decided to mandate TLS/SSL.
>>>>>> As distros migrate to latest mariadb it rears it’s ugly head.
>>>>>> At the mo the only distro I encounter the issue with is openSuSE tumbleweed/slowroll. You can disable the requirement at compile time. (of driver not the app)
>>>>>> openSuSE has 3 commented lines in my.cnf specifing where the certs are kept but every attempt that I have made to enable TLS on the db server results in error and mariadb not starting.
>>>>>> A while ago I posted about this and received an answer which I filed under ‘Important’. Needless to say I’ve lost all ‘Important’
>>>>>> So again I ask
>>>>>> a) anybody who has implimented TLS/SSL for db server
>>>>>> b) run mythtv on a recent tumbleweed/slowroll
>>>>>> to share
>>>>> 
>>>>> A little while ago, I installed mythtv to tumbleweed and it seemed to work fine. I used the packages from here: https://build.opensuse.org/project/show/home:Glidos.
>>>>> 
>>>>> I remember running into a problem with the database initially, and not being sure exactly what fixed it. I posted this about it:
>>>>> 
>>>>> "I eventually got around the various problems. You may well not be looking at using tumbleweed/slowroll any longer but there are now packages here: https://build.opensuse.org/project/show/home:Glidos. I tried them out and didn't seem to run into the SSL problems with the database. I did have problems with the database initially, but the error was "Plugin not loaded" and that went away when I followed instructions for setting up the timezone information. Before discovering that setting up the timezone was the cause, I did create an ssl certificate, so perhaps that's why I didn't see the problems you did."
>>>> Paul thanks. I naively believed I could compile myself out of any hole. I read that the app cannot configure away the TLS requirement so I was very keen to learn what he did. Alas the glidos rpm were identical. Leap 16.0 is due on OCT 1 so I’ll wait a few days and see if a db on 16.0 can get tls enabled. I danced in circles but I cannot get 15.6 to do TLS.
>>>> I also read the certs have to be located in mariadb’s home (/var/lib/mariadb) but no luck there either.
>>> 
>>> That's all very strange. I was assuming that your problem was specific to tumbleweed, because I've been running mythtv under Leap 15.6 without problem ever since it was released. I'm almost completely certain, I didn't create a certificate for myriadb on 15.6. I did for tumbleweed, but quite likely unnecessarily because it didn't fix the problem I was chasing down, and a later change did.
>>> 
>>> One thing I'm doing that you are very unlikely to be doing that might be relevant: I swap between two servers (actually VMs now, but used to be physical machines) on every new version of Leap, moving services like mythtv along with their databases. I use rsync for all the files I want to copy across, and mysqldump to move the databases. I wonder if in my use of mysqldump, I'm configuring TLS off in the target system. Wild speculation... I know little about how mariadb works. If not, I guess TLS is just working for me somehow.
>>> 
>>> Can you remind me what your symptoms are?
>> My backend and a frontend are leap 15.6 which work perfectly.
>> I cannot get the backend to run mariadb with TLS/SSL
>> I am trying 16.0 (RC). I have just built mythtv-35. Ansible threw a hissy fit with 10s of red pages !!
>> I will test later today.
>> I cannot get a tumbleweed/slowroll frontend which demand TLS/SSL to work. My assertion that ‘everybody will …’ is based on eventually everyone will be on a new mariadb. But you *can* compile the driver to not require TLS.
>> I tried, and was beaten, *fixing* suse’s driver.
> 
> Ah, I understand a little better now. But still, I recently had a 15.6 based frontend working with a tumbleweed based backend. For that particular scenario, I can say with absolute certainty, I did nothing explicit to do with TLS/SSL on the 15.6 frontend: that installation is a disc image created by kiwi; I'd have had to script anything non standard for TLS/SSL, and I didn't. So, somehow, my tumbleweed backend didn't demand TLS/SSL from the 15.6 frontend. Sorry, I have nothing more useful to say at the moment, but maybe that at least adds to the evidence when tracking this down and determining what is possible.

Paul a 15.6 frontend does not demand TLS from a tumbleweed backed so it works fine.
A tumbleweed front end does demand TLS and I cannot get a 15.6 backend to offer TLS.

I’m about to try a 16.0 frontend to a 16.0 backend.

James