feat(mariadb): use 10.11 client for <11.x servers, add --skip-ssl-verify-server-cert wrappers for 11.x, fixes #8119 by stasadev · Pull Request #8141 · ddev/ddev

stasadev · 2026-02-13T22:00:32Z

The Issue

Fixes "TLS/SSL error: SSL is required, but the server does not support it" on mariadb 10.6 #8119

MariaDB 11.4+ has self-signed certificates https://www.youtube.com/watch?v=JymQOSYTI-Y&t=73s
https://mariadb.org/mission-impossible-zero-configuration-ssl/

But when mariadb-client 11.4+ tries to connect to an older server, it fails, because self-signed certificates are not supported there.

Previously, ddev-webserver used mariadb-client 11.8 for all MariaDB versions below 10.11. This means even a MariaDB 10.6 server got the 11.8 client, which enforces SSL verification and fails to connect.

We already have a config for this:

ddev/containers/ddev-webserver/ddev-webserver-etc-skel/etc/skel/.my.cnf

Lines 11 to 12 in 500fc99

    
           [client-mariadb] 
        
           disable-ssl-verify-server-cert

But it doesn't work when using framework apps such as Drush or TYPO3 Console, because they use their own config mariadb --defaults-file=/tmp/... during the connection.

How This PR Solves The Issue

Two-pronged approach based on server version:

MariaDB below 11.x: Install mariadb-client 10.11 instead of 11.8. The 10.11 client does not enforce SSL verification, so it connects to older servers without issues.

MariaDB 11.x: Install mariadb-client matching the server version and create wrappers with --skip-ssl-verify-server-cert for:

mariadb
mariadb-admin
mariadb-analyze
mariadb-binlog
mariadb-check
mariadb-dump
mariadb-import
mariadb-optimize
mariadb-repair
mariadb-show
mariadb-slap
mariadbcheck

--skip-ssl-verify-server-cert is added as a last parameter, because --defaults-file is picky about argument order.

Manual Testing Instructions

Follow Drupal quickstart https://docs.ddev.com/en/stable/users/quickstart/#drupal with an older MariaDB database:

ddev config --database=mariadb:10.6

And run:

ddev drush sql-cli

Before:

$ ddev drush sql-cli
ERROR 2026 (HY000): TLS/SSL error: SSL is required, but the server does not support it

After:

$ ddev drush sql-cli
Welcome to the MariaDB monitor.

Check that the 10.11 client is installed for MariaDB 10.6:

$ ddev exec mariadb --version
mariadb  Ver 15.1 Distrib 10.11.16-MariaDB

Check that for MariaDB 11.x, wrappers are created instead:

ddev config --database=mariadb:11.4
ddev config --database=mariadb:11.8

$ ddev exec cat /usr/local/bin/mariadb
#!/usr/bin/env bash
#ddev-generated
exec -a mariadb "/usr/bin/mariadb" "$@" --skip-ssl-verify-server-cert

Automated Testing Overview

Release/Deployment Notes

github-actions · 2026-02-13T22:06:11Z

Download the artifacts for this pull request:

See Testing a PR.

rfay

Wow!

Should we also be considering using SSL optionally for communication between web and db?

stasadev · 2026-02-13T22:11:23Z

Should we also be considering using SSL optionally for communication between web and db?

It's already done automatically in MariaDB 11.4+
https://www.youtube.com/watch?v=JymQOSYTI-Y&t=73s
https://mariadb.org/mission-impossible-zero-configuration-ssl/

We don't actually need disable-ssl-verify-server-cert config or --skip-ssl-verify-server-cert flag to connect to the db server in MariaDB 11.4+.

I guess it's too much work to add SSL for every possible MariaDB version below 11.4.

And people may still need to connect to some external databases without SSL from the ddev-webserver.

rfay · 2026-02-13T22:23:51Z

It's already done automatically in MariaDB 11.4+

Didn't know that! But I was actually talking about configuring our server to do TLS.

rfay · 2026-02-14T14:54:29Z

Lima timing out after 4 hours, perhaps something wrong with runner, https://buildkite.com/ddev/macos-lima/builds/5712#019c5905-5b6e-4500-b779-32989145e0af (tb-macos-arm64-6 lima)

rfay · 2026-02-18T16:55:17Z

We should see if we can test this on Craft's db dump utility, which should have the same problem.

rfay · 2026-02-18T17:01:39Z

Bizarre:

ddev drush si success after failure

rfay@rfay-mba-m4:~/tmp/d11-mariadb-10.6$ ddev drush sql-cli
ERROR 2026 (HY000): TLS/SSL error: SSL is required, but the server does not support it

In Process.php line 280:

  The command "mariadb --defaults-file=/tmp/drush_0hcqa8s0r9l8dvJfIL5 --database=db --host=db --port=
  3306 -A" failed.

  Exit Code: 1(General error)

  Working directory: /var/www/html/web

  Output:
  ================


  Error Output:
  ================


Failed to run drush sql-cli: exit status 1
rfay@rfay-mba-m4:~/tmp/d11-mariadb-10.6$ ddev drush si
 You are about to:
 * CREATE the 'db' database.


 ┌ Do you want to continue? ────────────────────────────────────┐
 │ Yes                                                          │
 └──────────────────────────────────────────────────────────────┘

 [warning] Failed to drop or create the database. Do it yourself before installing. ERROR 2026 (HY000): TLS/SSL error: SSL is required, but the server does not support it

 [notice] Starting Drupal installation. This takes a while.
 [notice] Performed install task: install_select_language
 [notice] Performed install task: install_select_profile
 [notice] Performed install task: install_load_profile
 [notice] Performed install task: install_verify_requirements
 [notice] Performed install task: install_verify_database_ready
 [notice] Performed install task: install_base_system
 [notice] Performed install task: install_bootstrap_full
 [notice] Performed install task: install_profile_modules
 [notice] Performed install task: install_profile_themes
 [notice] Performed install task: install_install_profile
 [notice] Performed install task: install_configure_form
 [notice] Performed install task: install_finished
 [success] Installation complete. (Admin)
 [success] User name: admin  User password: UUVLuipzMx
rfay@rfay-mba-m4:~/tmp/d11-mariadb-10.6$
rfay@rfay-mba-m4:~/tmp/d11-mariadb-10.6$ ddev mysql
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 16
Server version: 10.6.24-MariaDB-ubu2204-log mariadb.org binary distribution

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [db]> show tables;
+----------------------------------+
| Tables_in_db                     |
+----------------------------------+
| block_content                    |
| block_content__body              |
| block_content_field_data         |
| block_content_field_revision     |
| block_content_revision           |
| block_content_revision__body     |
| comment                          |
| comment__comment_body            |
| comment_entity_statistics        |
| comment_field_data               |
| config                           |

rfay · 2026-02-18T18:02:53Z

This works great of course, but I have questions and haven't fully grokked all the intent.

Could you flesh out body just a bit more?

What mariadb versions are affected and why (and how)? Mariadb 10.11 is not. 10.6 yes, dramatically. Table would be great.
Slightly more explanation about what really happens with the wrappers.
When is the choice made about installing the wrappers?
Are the wrappers always used if installed?
Is there any conflict about the old mysql that was traditional, vs Maria's current mariadb + mysql symlink.
Do we need anything in docs?

This absolutely solves a very real problem, and waiting for the tools that encounter it doesn't seem like a very successful approach. But it has quite a lot of complexity risk. We're taking basic behavior and trying to roll it back, which usually has unintended consequences.

stasadev · 2026-02-18T18:17:41Z

What mariadb versions are affected and why (and how)? Mariadb 10.11 is not. 10.6 yes, dramatically. Table would be great.

We install MariaDB 11.8 client inside the ddev-webserver, this is our default.
The problem appeared because everything below MariaDB 10.11 uses MariaDB 11.8 client.

Slightly more explanation about what really happens with the wrappers.

I create wrappers in /usr/local/bin/ for some of the mariadb* commands, these wrappers run the exact same command as requested, but with addition of the --skip-ssl-verify-server-cert flag. This is needed because disable-ssl-verify-server-cert inside $HOME/.my.cnf is not respected by external programs.

When is the choice made about installing the wrappers?

I decided to preinstall them, so they already come bundled with ddev-webserver, if you change the default database to MySQL, they are removed completely. And when you change it to MariaDB 10.11, they are also removed.

Are the wrappers always used if installed?

Yes.

Is there any conflict about the old mysql that was traditional, vs Maria's current mariadb + mysql symlink.

No, mysql wrapper will call mariadb wrapper, which will call the original /usr/bin/mariadb

Do we need anything in docs?

I don't think we need to add anything.

stasadev · 2026-02-18T19:52:48Z

After internal discussion we decided it's better to keep MariaDB 10.11 client for all old MariaDB servers:

Server inside ddev-dbserver	Client inside ddev-werserver
mariadb:11.8	mariadb:11.8
mariadb:11.4	mariadb:11.4
mariadb:10.11	mariadb:10.11
mariadb:10.8	mariadb:10.11
mariadb:10.7	mariadb:10.11
mariadb:10.6	mariadb:10.11
...	mariadb:10.11

Run this to download the updated ddev-webserver:

ddev utility download-images

The MariaDB 10.11 client doesn't use any wrappers, so even if there is an issue with the wrappers, it would only affect MariaDB 11.x.

rfay

I ran out of gas partway through this, but manual testing was working great. Exactly what I hoped for.

rfay · 2026-02-19T03:03:11Z

A note: Since this was done against fork, some of the more extensive tests like TestDdevAllDatabases may not be run against everything until it gets pulled.

stasadev requested a review from a team as a code owner February 13, 2026 22:00

github-actions bot added dependencies Pull requests that update a dependency file enhancement labels Feb 13, 2026

rfay reviewed Feb 13, 2026

View reviewed changes

rfay mentioned this pull request Feb 16, 2026

"TLS/SSL error: SSL is required, but the server does not support it" with database commands on DDEV TYPO3-Console/TYPO3-Console#1215

Open

rfay force-pushed the 20260213_stasadev_mariadb_skip_ssl branch from 4a45799 to fd6eff5 Compare February 17, 2026 03:16

stasadev added 2 commits February 18, 2026 21:24

feat(mariadb): add client wrappers for --skip-ssl-verify-server-cert

bf7112a

install 10.11 client for older MariaDB [skip ci]

8cb0da2

stasadev force-pushed the 20260213_stasadev_mariadb_skip_ssl branch from fd6eff5 to 8cb0da2 Compare February 18, 2026 19:38

stasadev changed the title ~~feat(mariadb): add client wrappers for --skip-ssl-verify-server-cert, fixes #8119~~ feat(mariadb): use 10.11 client for <11.x servers, add --skip-ssl-verify-server-cert wrappers for 11.x, fixes #8119 Feb 18, 2026

stasadev requested a review from rfay February 18, 2026 19:52

Run tests

05324d5

rfay reviewed Feb 19, 2026

View reviewed changes

stasadev merged commit 39a79a6 into ddev:main Feb 19, 2026
44 of 45 checks passed

stasadev deleted the 20260213_stasadev_mariadb_skip_ssl branch February 19, 2026 11:15

Uh oh!

Comments

Conversation

stasadev commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

The Issue

How This PR Solves The Issue

Manual Testing Instructions

Automated Testing Overview

Release/Deployment Notes

Uh oh!

github-actions bot commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rfay left a comment

Choose a reason for hiding this comment

Uh oh!

stasadev commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rfay commented Feb 13, 2026

Uh oh!

rfay commented Feb 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rfay commented Feb 18, 2026

Uh oh!

rfay commented Feb 18, 2026

Uh oh!

rfay commented Feb 18, 2026

Uh oh!

stasadev commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

stasadev commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rfay left a comment

Choose a reason for hiding this comment

Uh oh!

rfay commented Feb 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

stasadev commented Feb 13, 2026 •

edited

Loading

github-actions bot commented Feb 13, 2026 •

edited

Loading

stasadev commented Feb 13, 2026 •

edited

Loading

rfay commented Feb 14, 2026 •

edited

Loading

stasadev commented Feb 18, 2026 •

edited

Loading

stasadev commented Feb 18, 2026 •

edited

Loading