Fix things so that chains of certificates work in the server and client certificate files. This only really works for OpenSSL-based builds, as yassl is unable to read multiple certificates from a file. The patch below to yassl/src/ssl.cpp doesn't fix that, but just arranges that the viosslfactories.c patch won't have any ill effects in a yassl build. Since we don't use yassl in Red Hat/ Fedora builds, I'm not feeling motivated to try to fix yassl for this. See RH bug #598656. Filed upstream at http://bugs.mysql.com/bug.php?id=54158 diff -Naur mysql-5.5.28.orig/extra/yassl/src/ssl.cpp mysql-5.5.28/extra/yassl/src/ssl.cpp --- mysql-5.5.28.orig/extra/yassl/src/ssl.cpp 2012-08-29 04:50:46.000000000 -0400 +++ mysql-5.5.28/extra/yassl/src/ssl.cpp 2012-09-29 12:45:19.682287214 -0400 @@ -1627,10 +1627,10 @@ } - int SSL_CTX_use_certificate_chain_file(SSL_CTX*, const char*) + int SSL_CTX_use_certificate_chain_file(SSL_CTX* ctx, const char* file) { - // TDOD: - return SSL_SUCCESS; + // For the moment, treat like use_certificate_file + return read_file(ctx, file, SSL_FILETYPE_PEM, Cert); } diff -Naur mysql-5.5.28.orig/vio/viosslfactories.c mysql-5.5.28/vio/viosslfactories.c --- mysql-5.5.28.orig/vio/viosslfactories.c 2012-08-29 04:50:46.000000000 -0400 +++ mysql-5.5.28/vio/viosslfactories.c 2012-09-29 12:46:35.124975585 -0400 @@ -106,7 +106,7 @@ key_file= cert_file; if (cert_file && - SSL_CTX_use_certificate_file(ctx, cert_file, SSL_FILETYPE_PEM) <= 0) + SSL_CTX_use_certificate_chain_file(ctx, cert_file) <= 0) { *error= SSL_INITERR_CERT; DBUG_PRINT("error",("%s from file '%s'", sslGetErrString(*error), cert_file));