{"record":{"id":"b9f570c7957f2d48","repo":"vitessio/vitess","slug":"no-client-certs-for-connection","errorCode":null,"errorMessage":"no client certs for connection","messagePattern":"no client certs for connection","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"go/mysql/auth_server_clientcert.go","lineNumber":91,"sourceCode":"}\n\n// DefaultAuthMethodDescription returns always MysqlNativePassword\n// for the client certificate authentication setup.\nfunc (asl *AuthServerClientCert) DefaultAuthMethodDescription() AuthMethodDescription {\n\treturn MysqlNativePassword\n}\n\n// HandleUser is part of the UserValidator interface. We\n// handle any user here since we don't check up front.\nfunc (asl *AuthServerClientCert) HandleUser(user string) bool {\n\treturn true\n}\n\n// UserEntryWithPassword is part of the PlaintextStorage interface\nfunc (asl *AuthServerClientCert) UserEntryWithPassword(conn *Conn, user string, password string, remoteAddr net.Addr) (Getter, error) {\n\tuserCerts := conn.GetTLSClientCerts()\n\tif len(userCerts) == 0 {\n\t\treturn nil, errors.New(\"no client certs for connection\")\n\t}\n\tcommonName := userCerts[0].Subject.CommonName\n\n\tif user != commonName {\n\t\treturn nil, fmt.Errorf(\"MySQL connection username '%v' does not match client cert common name '%v'\", user, commonName)\n\t}\n\n\treturn &StaticUserData{\n\t\tUsername: commonName,\n\t\tGroups:   userCerts[0].DNSNames,\n\t}, nil\n}\n","sourceCodeStart":73,"sourceCodeEnd":104,"githubUrl":"https://github.com/vitessio/vitess/blob/01a25a7d176f94613b8d59d799f438380a8760e4/go/mysql/auth_server_clientcert.go#L73-L104","documentation":"AuthServerClientCert.UserEntryWithPassword authenticates MySQL users by matching the username against the Common Name of the client's TLS certificate. This error means the connection presented no client certificate at all, so there is no Common Name to compare against; authentication cannot proceed.","triggerScenarios":"A client connects with TLS but without a client certificate (or with tls.Config that doesn't request/present one) while the auth server is AuthServerClientCert; conn.GetTLSClientCerts() returns an empty list.","commonSituations":"Client configured with only server-side CA verification (no cert/key in client config); mysql client run without --ssl-cert/--ssl-key; a proxy/load balancer terminating TLS and not forwarding the client cert; TLSClientAuth set to NoClientCert in server TLS config.","solutions":["Configure the client to present a client certificate signed by the server's CA (e.g. mysql --ssl-cert=client-cert.pem --ssl-key=client-key.pem)","Set ClientAuth to tls.RequireAndVerifyClientCert (or at least RequestClientCert) in the server TLS config so certs are requested and enforced","Check any TLS-terminating proxy forwards the client certificate to Vitess","If client-cert auth is not intended, switch the auth server to password-based (AuthServerStatic/ldap etc.)"],"exampleFix":"// before (client)\nconn, err := mysql.Connect(ctx, params) // no client cert in params\n// after\nparams.SslCert = \"client-cert.pem\"\nparams.SslKey = \"client-key.pem\"\nconn, err := mysql.Connect(ctx, params)","handlingStrategy":"validation","validationCode":"// client side, before connecting:\nif certPEM == \"\" || keyPEM == \"\" { return errors.New(\"client-cert auth requires --ssl-cert/--ssl-key\") }\n// load and verify the cert has a Common Name matching the MySQL username","typeGuard":"func hasClientCert(c *tls.ConnectionState) bool { return c != nil && len(c.PeerCertificates) > 0 }","tryCatchPattern":"getter, err := asl.UserEntryWithPassword(conn, user, pass, addr)\nif err != nil && strings.Contains(err.Error(), \"no client certs\") {\n    return nil, status.Errorf(codes.Unauthenticated, \"client certificate required\")\n}","preventionTips":["Always configure client cert+key when AuthServerClientCert is enabled","Set tls.ClientAuth to RequireAndVerifyClientCert on the server","Keep the cert Common Name equal to the MySQL username","Check TLS-terminating proxies forward client certificates"],"tags":["mysql","tls","authentication","client-certificate"],"backgroundTag":"missing-client-certificate","analyzedSha":"01a25a7d176f94613b8d59d799f438380a8760e4","analyzedAt":"2026-09-01T17:28:30.605Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}