Is 'allowPublicKeyRetrieval=true&useSSL=false' safe for production machines to avoid the "MySql : Public Key Retrieval is not allowed" error?
I have a web app built with Java and Spring MVC that connects to a MySQL database.
When I attempt to connect to fresh MySQL installation on a clean Windows PC, the connection fails with the error:
java.sql.SQLNonTransientConnectionException: Public Key Retrieval is not allowed According to this other StackOverflow answer here … I can avoid this error messages by including this in the connection URL …
allowPublicKeyRetrieval=true&useSSL=false
This makes it work, however this workaround appears to open security vulnerabilities.
My question is … It is safe to recommend to my users that they use allowPublicKeyRetrieval=true&useSSL=false ?
If not, what is the "correct" way to address this error message? For example … should I be manually retrieving the public key from the MySQL Server and manually inserting it in the keystore of the JVM running my Tomcat server, or something like that?
