Is it possible to force mysql server authentication using django.db.backends.mysql?

Question

it's my first question on stack overflow because I can't find relevant information in Django documentation. Is it possible to force mysql server authentication with ssl using django.db.backends.mysql? I have checked its implementation in Django Github and it seems it supports only 3 ssl arguments: ca, cert and key. What I need is equivalent of --ssl-mode=VERIFY_IDENTITY. Has anyone found some workaround for this problem? Here is my current configuration. TLS channel is working as expected, but identity of MySQL server is not validated.

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.mysql',
        'NAME': env('DB_NAME'),
        'USER': env('DB_USER'),
        'PASSWORD': env('DB_PASSWORD'),
        'HOST': env('DB_HOST'),
        'PORT': env('DB_PORT'),
        'CONN_MAX_AGE': 600,
        'OPTIONS':{
            'ssl':{
                'ca': env('CA_CERT'),
                'cert': env('CERT'),
                'key': env('KEY')
            }
        }
    }
}

options are passed as kwargs so --ssl-mode is ssl_mode

iklinac
– iklinac

2025-10-26 13:10:17 +00:00
Commented Oct 26 at 13:10 — iklinac
– iklinac, Commented Oct 26 at 13:10

Mohamed Hussain S · Accepted Answer · 2025-10-25 09:30:32Z

1

Yes - but Django doesn’t expose ssl-mode directly, you must pass it through the MySQL driver (mysqlclient or PyMySQL) using OPTIONS.

answered Oct 25 at 9:30

Mohamed Hussain S

663 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

CRM-Thunder Oct 25 at 9:55

I have tried doing something like this: 'OPTIONS':{ 'ssl':{ 'ca': env('CA_CERT'), 'cert': env('CERT'), 'key': env('KEY'), 'ssl-mode': 'VERIFY_IDENTITY' } } but it didn't work and then I checked django.db.backends.mysql code where I found only three arguments parsed mentioned earlier.

Mohamed Hussain S Oct 28 at 10:15

You’re right, Django only parses the three SSL fields (ca, cert, key) from the ssl dict. ssl-mode inside there will be ignored. Instead, you can try passing ssl_mode at the top level of OPTIONS, like this - 'OPTIONS': { 'ssl_mode': 'VERIFY_IDENTITY', 'ssl': { 'ca': env('CA_CERT'), 'cert': env('CERT'), 'key': env('KEY'), }, } ssl_mode is supported by the underlying MySQL drivers, so this should enable identity verification.

Collectives™ on Stack Overflow

Is it possible to force mysql server authentication using django.db.backends.mysql?

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related