pymysql cannot connect with SSL

Question

I am trying to connect to a MySQL database using python but I am getting a strange error. It is compounded by the fact that I can use the same connection values from the mysql console command and it connects with no problems.

Here is the exact code I am using:

import pymysql from checks import AgentCheck

class DelayedJobCheck(AgentCheck):
    def check(self, instance):
        self.log.info("testing connection")
        self.log.info(instance)

        connection = pymysql.connect(**instance)

        cur = cnx.cursor(buffered=True)
        cur.execute("SHOW STATUS LIKE 'Ssl_cipher'")
        print(cur.fetchone())
        cur.close()
        cnx.close()

        self.gauge('hello.world', 1)

This is the error that I am getting:

Traceback (most recent call last):
  File "/opt/datadog-agent/agent/checks/__init__.py", line 661, in run
    self.check(copy.deepcopy(instance))
  File "/opt/datadog-agent/agent/checks.d/delayed_job.py", line 10, in check
    connection = pymysql.connect(**instance)
  File "/opt/datadog-agent/embedded/lib/python2.7/site-packages/pymysql/__init__.py", line 88, in Connect
    return Connection(*args, **kwargs)
  File "/opt/datadog-agent/embedded/lib/python2.7/site-packages/pymysql/connections.py", line 644, in __init__
    self._connect()
  File "/opt/datadog-agent/embedded/lib/python2.7/site-packages/pymysql/connections.py", line 869, in _connect
    raise exc
OperationalError: (2003, u"Can't connect to MySQL server on '192.168.199.86' ([SSL: SSL_NEGATIVE_LENGTH] dh key too small (_ssl.c:590))")

I am running this code on a Ubuntu box and I though initially that it might be because the SSL CA is a self generated cert. So I followed the steps here But, it did not make any difference. Also I have verified that the process that is running this code has full access to the cert files

Any ideas what else might be causing this?

Answer 1

As the err info said dh key is too small, a larger one might help. Replace the default dh512.pem file with dh4096.pem

sudo wget "https://git.openssl.org/gitweb/?p=openssl.git;a=blob_plain;f=apps/dh4096.pem" -O dh4096.pem

Ref: http://www.alexrhino.net/jekyll/update/2015/07/14/dh-params-test-fail.html