From 6c16ce6442af52a22357da69e41968f99c69d300 Mon Sep 17 00:00:00 2001 From: Seunghun Lee Date: Mon, 22 Jun 2026 13:01:54 +0200 Subject: [stable-only] Split CA of ProxySQL internal TLS and backend TLS ProxySQL frontend TLS (database internal TLS) and backend TLS (database backend TLS) expects different CA if users use chain of certificates (e.g. use of intermediate certificates). Frontend TLS expects the intermediate certificate that signed the leaf certificate as a CA file, whereas backend TLS expects root CA. To fix, users are now required to create a file named ``proxysql-ca.pem`` at ``kolla_certificates_dir``, which is a copy of the intermediate certificate. If your system is not affected by this bug, you're not required to create the new file ``proxysql-ca.pem``. Closes-bug: #2150449 Change-Id: I88911badb0d0801f79317df6681c571cc1c8cfee Signed-off-by: Seunghun Lee --- ...ix-proxysql-database-internal-tls-b401e564ec39a633.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 releasenotes/notes/fix-proxysql-database-internal-tls-b401e564ec39a633.yaml (limited to 'releasenotes') diff --git a/releasenotes/notes/fix-proxysql-database-internal-tls-b401e564ec39a633.yaml b/releasenotes/notes/fix-proxysql-database-internal-tls-b401e564ec39a633.yaml new file mode 100644 index 000000000..fb3fb9db9 --- /dev/null +++ b/releasenotes/notes/fix-proxysql-database-internal-tls-b401e564ec39a633.yaml @@ -0,0 +1,14 @@ +--- +fixes: + - | + Fixes bug `LP#2150449 `__ + where ProxySQL's database internal TLS fails when users use chain of + certificates (e.g. use of intermediate certificates). + + Users who are affected by this bug needs to create a file + ``proxysql-ca.pem`` at ``certificates_internal_dir``. + This file needs to be a copy of the intermediate certificate (i.e. + certificate that signed database internal TLS) + + Users who are not affected by this bug does not need to do + anything. -- cgit v1.2.3