Ubuntu22.04客户端通过TLSv1.1连接MariaDB服务器遇SSL错误求助

Debian 10系统上运行着版本为10.3.34-MariaDB-0+deb10u1-log的MariaDB服务器，通过仓库包安装，采用YaSSL 2.4.4编译，最高仅支持TLSv1.1版本。
客户端使用Ubuntu 22.04（内核版本5.15.0-52-generic），MariaDB客户端依赖本地安装的OpenSSL 3.0.2。

执行以下连接命令时：

mysql --tls-version=TLSv1.1 -v -v -v --ssl-cert="/home/leon/certs/client-cert.pem" --ssl-key="/home/leon/certs/client-key.pem" -umyuser -hmaria.example.de -p

出现错误：ERROR 2026 (HY000): SSL connection error: no protocols available。

尝试手动在客户端启用TLSv1.1，创建配置文件/etc/ssl/unsafe.cnf：

openssl_conf = default_conf
[default_conf] ssl_conf = ssl_sect
[ssl_sect] system_default = system_default_sect
[system_default_sect] MinProtocol = TLSv1.1 CipherString = DEFAULT@SECLEVEL=1

通过export OPENSSL_CONF=/etc/ssl/unsafe.cnf启用后，连接时出现错误：ERROR 2026 (HY000): SSL connection error: unsafe legacy renegotiation disabled。

随后在配置文件的[system_default_sect]段添加Options = UnsafeLegacyRenegotiation，再次连接又出现错误：ERROR 2026 (HY000): SSL connection error: internal error。

疑问：是配置文件存在问题，还是无法同时启用UnsafeLegacyRenegotiation与TLSv1.1？

附openssl s_client -tls1_1 --starttls mysql python.fairtragen.de:3306命令输出：

CONNECTED(00000003)
depth=0 CN = python.fairtragen.de, L = Bremen, O = fairtragen GmbH, OU = " ", emailAddress = python@fairtragen.de, C = DE
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = python.fairtragen.de, L = Bremen, O = fairtragen GmbH, OU = " ", emailAddress = python@fairtragen.de, C = DE
verify error:num=21:unable to verify the first certificate
verify return:1
depth=0 CN = python.fairtragen.de, L = Bremen, O = fairtragen GmbH, OU = " ", emailAddress = python@fairtragen.de, C = DE
verify return:1
40F70087447F0000:error:0A0C0103:SSL routines:tls_process_key_exchange:internal error:../ssl/statem/statem_clnt.c:2248:
---
Certificate chain
 0 s:CN = python.fairtragen.de, L = Bremen, O = fairtragen GmbH, OU = " ", emailAddress = python@fairtragen.de, C = DE
   i:C = DE, ST = Some-State, O = fairtragen GmbH, CN = fairCA, emailAddress = fellows@fairtragen.de
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Apr 20 00:00:00 2021 GMT; NotAfter: Apr 20 00:00:00 2031 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIEdDCCAlwCAQAwDQYJKoZIhvcNAQELBQAwczELMAkGA1UEBhMCREUxEzARBgNV
BAgMClNvbWUtU3RhdGUxGDAWBgNVBAoMD2ZhaXJ0cmFnZW4gR21iSDEPMA0GA1UE
AwwGZmFpckNBMSQwIgYJKoZIhvcNAQkBFhVmZWxsb3dzQGZhaXJ0cmFnZW4uZGUw
IhgPMjAyMTA0MjAwMDAwMDBaGA8yMDMxMDQyMDAwMDAwMFowgYgxHTAbBgNVBAMM
FHB5dGhvbi5mYWlydHJhZ2VuLmRlMQ8wDQYDVQQHDAZCcmVtZW4xGDAWBgNVBAoM
D2ZhaXJ0cmFnZW4gR21iSDEKMAgGA1UECwwBIDEjMCEGCSqGSIb3DQEJARYUcHl0
aG9uQGZhaXJ0cmFnZW4uZGUxCzAJBgNVBAYTAkRFMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEAtvTsn5+GCuhFztfyzLG8T3YQNf3/jmMIP/rZKCTC6D+K
neKeXBUBkWyPT7398h8lJtfZhfK6TRPR4VmrCnxYuWJL2LdwSACcRcyA0rRgE9SC
8Y7LJulcyetl/JjQAXY6/wFdMcEHRqlCzyTEqumsJsImcE2hHbnNIHd9OukmB8Qq
oS1/e6fKQTjvR90huIyRhHtCMFYiAglCMbmPRuFflzFZ6cULdL0Se7oiLIbsdamV
oFUXk3crcZP3EAR0UMqZ/hQN8vTphDHOngOuss/ORBo0ezxTOXC2Gpmz5RmJKWbN
Ch5tUgIgPEK/cdiz7LnA/CbDXKsWlnEfhoVfL00shwIDAQABMA0GCSqGSIb3DQEB
CwUAA4ICAQAJtzQxuGNHlS5LYJkx2CTJTm44PmbuKOfuR8qwjAnsfDHuevADjwCf
aeH9D5pxpdYFdH8Ll9RzynxTAIHQQLcBzIrTCbouQwOZqpNXszbJhrKjEJ+yOJjM
+LnYfnQRttC6G7gjTHIOixLwOeaRuMCwaZXCYitwPR+6PCfQG+4AFZlOvNIOQDlD
arDJJoAXgE0RH+YlVfyNcSZUMaxOJYK4awN8/5lCLsCk8CZ2/mfOz9DdCKirou5U
Z+Sbu4zPLF49F1xXVK7+omdys57dCXto6ykWahXtrMH/A4JjIsf4GBv2s/im9PTK
9tXPBjk6VT6ZsSCBHa62hzvTiZMzRRBLNlPMldbQerO6/Q/18DueoYT1+e6/Aw3k
/nXgnB7Ztjbemuj1D22MNSHyclRt5ifUskGGLc0nl54rJQCnhTdZW6UwDyCpSDU8
n82Omclgfndyt71I3ecxsCduhHjd+5Nn7e2sIyttPhHLeP6hTbjgDwgSAeHjrjD+
VeKBoahnyXqhWMNQPhkgqPQH6VEQjAaB7NwewfiNziWy3Nd+ThgHJFNP9vHYyeju
2IaE+JBegGgxus0/IQeFTkGuZat7cEMoHE9TQEeGJ6fpqTyeEuqVG/ulAm5qT6zy
ZGOI/RjKGo68AqISogpA2vcWel/h//qyYDQ/683MtPDwef2uKbcH6g==
-----END CERTIFICATE-----
subject=CN = python.fairtragen.de, L = Bremen, O = fairtragen GmbH, OU = " ", emailAddress = python@fairtragen.de, C = DE
issuer=C = DE, ST = Some-State, O = fairtragen GmbH, CN = fairCA, emailAddress = fellows@fairtragen.de
---
No client certificate CA names sent
Server Temp Key: DH, 2048 bits
---
SSL handshake has read 2131 bytes and written 176 bytes
Verification error: unable to verify the first certificate
---
New, (NONE), Cipher is (NONE)
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.1
    Cipher    : 0000
    Session-ID: E81DDD60800D1F4505F5A5D0A273E776EAEDDAF205BD2195092D7132EAAC0F53
    Session-ID-ctx: 
    Master-Key: 
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1666861958
    Timeout   : 7200 (sec)
    Verify return code: 21 (unable to verify the first certificate)
    Extended master secret: no
---

• 配置文件格式错误
  你的OpenSSL配置文件里，多个配置项挤在同一行会导致解析失败。正确的格式应该把每个配置段和配置项单独成行：

  openssl_conf = default_conf
  
  [default_conf]
  ssl_conf = ssl_sect
  
  [ssl_sect]
  system_default = system_default_sect
  
  [system_default_sect]
  MinProtocol = TLSv1.1
  CipherString = DEFAULT@SECLEVEL=1
  Options = UnsafeLegacyRenegotiation
  

• TLSv1.1与不安全协商的兼容性问题
  OpenSSL 3.0允许同时启用TLSv1.1和UnsafeLegacyRenegotiation，但YaSSL 2.4.4的TLSv1.1实现和OpenSSL 3.0存在握手细节不兼容。从s_client输出看，握手时密钥交换阶段报错，且Cipher显示为0000，说明协商完全失败。另外服务器用的是自签名CA证书，客户端未信任该CA，也会加重握手异常。可以尝试在连接命令里添加--ssl-ca="/path/to/fairCA.pem"指定CA证书，或者临时关闭证书验证（仅测试用）：--ssl-mode=REQUIRED --ssl-verify-server-cert=false。

• 临时替代方案
  如果调整配置后还是不行，可以试试用mysql-connector-odbc等其他客户端工具；如果服务器允许，最好升级Debian 10上的MariaDB版本——新版本已支持TLSv1.2+，从根源上避免老旧协议的兼容性问题。

内容的提问来源于stack exchange，提问作者Leon