拒绝访问远程MySQL连接请求

Question

I have a mysql database (v5.5.41) setup on a remote server and an application connects to the DB from another server to run some queries. It's been working fine but recently my DB server got a new IP address. My application can't connect to the DB anymore, the connection times out.

The application is using the DNS name of the server, not a hard-coded IP, so there shouldn't be a problem. In any case, if I run this from the application server:

mysql -u app_user -h mydb.myhost.com -p

then I get

ERROR 1045 (28000): Access denied for user 'app_user'@'xxx.xxx.xxx.xxx' (using password: YES) 

If it was having trouble finding the new IP, then that command would probably just hang and timeout, so it seems to be an authentication issue. My password is definitely correct, but the application is using the same password as when the app was connecting successfully so it's not an issue of mistyping it.

I've tried deleting the user app_user from the database and re-creating, exactly as I did in the beginning:

CREATE USER 'app_user'@'xxx.xxx.xxx.xxx' IDENTIFIED BY 'mypassword';
GRANT SELECT ON mydb.* TO 'app_user'@'xxx.xxx.xxx.xxx' IDENTIFIED BY 'mypassword' REQUIRE SSL;
FLUSH PRIVILEGES;

I'm not sure if the DB server IP change is just a coincidence, and maybe there's some other issue.

The entry for app_user in select user, host from mysql.user shows the same IP address as in the Access Denied message above. For what it's worth, I tried changing the DB user host to * and got Host 'xxx.xxx.xxx.xxx' is not allowed to connect to this MySQL server .

Could this have something to do with SSL being required by connection attempts from this user?

Answer 1

The problem was related to the REQUIRE SSL in the privileges for my user. Without it, I could connect just fine. I got things working again by putting my client-cert.pem and client-key.pem files on the application server, updated my.cnf by adding:

ssl-cert = /path/to/client-cert.pem
ssl-key  = /path/to/client-key.pem 

...under the [client] section and restarted the mysql server.

However, I still don't understand why I was able to connect successfully before when I had done none of these things.