INTERNAL I just tried proxy-v2 and still got the same errors
(prod) marc.hoppins.ipa@d2-hmaster01:~<mailto:[email protected]:~> $ mysql -h d2-haproxy02 -P 3306 -u march -p -e "select customerNumber,customerName,city,country,creditLimit from classicmodels.customers limit 20;" Enter password: ERROR 2026 (HY000): SSL connection error: error:0A00010B:SSL routines::wrong version number (prod) marc.hoppins.ipa@d2-hmaster01:~<mailto:marc.hoppins.ipa@d2-hmaster01:~> $ mysql -h d2-haproxy02 -P 3306 -u march -p --ssl-mode=DISABLED -e "SELECT 1;" Enter password: ERROR 2013 (HY000): Lost connection to MySQL server during query From: Илья Шипицин <[email protected]> Sent: Thursday, June 18, 2026 2:02 PM To: Marc Hoppins <[email protected]> Cc: [email protected] Subject: [SPAM] Re: [EXT]Re: HAProxy and Percona [External Sender] I've checked my config, I also use "send-proxy-v2" on "server" lines backend bk_vpn mode tcp server server-vpn 192.168.1.10:1443<http://192.168.1.10:1443> send-proxy-v2 not sure which proxy protocol version is supported by percona, I mean those lines: server d2-db-node01 xx.xx.140.45:3306 server d2-db-node02 xx.xx.140.46:3306 backup server d2-db-node03 xx.xx.140.47:3306 backup чт, 18 июн. 2026 г. в 13:56, Marc Hoppins <[email protected]<mailto:[email protected]>>: INTERNAL It is claimed to exist and there is a setting for it. /etc/mysql/percona-xtradb-cluster.conf.d/mysqld.cnf [mysqld] proxy_protocol_networks="10.99.140.0/22<http://10.99.140.0/22>" From: Илья Шипицин <[email protected]<mailto:[email protected]>> Sent: Thursday, June 18, 2026 10:51 AM To: Marc Hoppins <[email protected]<mailto:[email protected]>> Cc: [email protected]<mailto:[email protected]> Subject: [EXT]Re: HAProxy and Percona [External Sender] you are trying to pass connection to mysql using so called "proxy protocol" it is super thing preserving original ip address however, I'm not sure "proxy protocol" listen is available for mysql. at least, I could find one ср, 17 июн. 2026 г. в 14:08, Marc Hoppins <[email protected]<mailto:[email protected]>>: INTERNAL Hi, I am trying to get source IP recognition sorted to a percona cluster. Following a directive to configure the proxy/percona setup to correctly identify client operations by source address, I reconfigured percona backends with send-proxy. I now have: source-host - proxy-node - percona node (8.4.7) I installed mysql. If I connect to source to proxy-node:3306 I get:- ERROR 2026 (HY000): SSL connection error: error:0A00010B:SSL routines::wrong version number I did try (from source) openssl s_client and gave path to the directory where our certificates are. It is the same path on all installed hosts companywide and contains the same base certificates, including our own self-signed one(s). I do see verify error:num=19:self-signed certificate in certificate chain from the output but I am reluctant to admit this is the cause. I did try removing (commenting out) the ssl bind options fro HAproxy config and restarting but the same error (ERROR 2026) appears. I can find no 8.4.7 client from percona. HAPROXY for the front/back defaults pxc_d2 log global mode tcp option tcplog option dontlognull retries 3 timeout connect 10s timeout client 1h timeout server 1h frontend pxc-d2-frontend from pxc_d2 bind *:3306 use_backend pxc-d2-backend backend pxc-d2-backend from pxc_d2 default-server inter 1001 rise 3 fall 3 on-marked-down shutdown-sessions default-server port 9200 check send-proxy balance roundrobin server d2-db-node01 xx.xx.140.45:3306 server d2-db-node02 xx.xx.140.46:3306 backup server d2-db-node03 xx.xx.140.47:3306 backup Where would I see any access attempts from client to target? The haproxy.log shows nothing, only regular Zabbix connections. Initially I contacted percona thinking that it was a problem with TLS/SSL and their interactions may be seen here https://forums.percona.com/t/connecting-to-database-through-haproxy/40920 Any ideas would be helpful. Marc
