Skip to content

Conversation

@mingley
Copy link

@mingley mingley commented Dec 19, 2025

Summary

  • add a tls_server_name override to MySqlConnectOptions
  • use the override for TLS SNI and hostname verification during the MySQL TLS upgrade handshake
  • add a small unit test + docs for the new option

Problem

VerifyIdentity ties both TLS SNI and certificate hostname verification to the TCP host value. In
real deployments (e.g., HAProxy or multi-instance pools), clients often connect via an IP or
internal alias that does not match the server certificate’s DNS name. This causes TLS verification
failures even when the CA and certificate are correct.

Rationale

This change lets users explicitly specify the TLS server name used for SNI + hostname verification
while keeping the TCP host unchanged. It is additive and opt-in: existing behavior is unchanged
unless the new option is set.

Testing

  • cargo fmt
  • cargo clippy -p sqlx-mysql -- -D warnings
  • cargo test -p sqlx-mysql
  • local integration test against a HAProxy-fronted MySQL-compatible endpoint (e.g., TiDB) with VerifyIdentity enabled; connection + simple query succeeded using the SNI override

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant