Feature request: Support TLS file references for MySQL connection

[Xolog]

In my case i have problem with connection to cloud db with tls. You have to specify skip-tls, which is not desirable.

It would be good to add support for adding your own certificate to connect to the database.

[burningalchemist]

Hey @Xolog, it is supported by drivers (unless it's MySQL). Please share your configuration - specifically the connection string (omitting sensitive data such as username/password), so i can assist you.

[Xolog]

I have Cloud MySQL and it require tls. Now I connected like this

data_source_name: 'mysql://{{ db_user }}:{{ db_password }}@{{ db_url }}:3306/{{db_name}}?tls=skip-verify'

But I have a certificate for connecting to cloud resources, which must be specified in the connection string.

My connection string when I try use cert
data_source_name: mysql://{{ db_user }}:{{ db_password }}@{{ db_url }}:3306/{{db_name}}?useSSL=true&ssl-mode=VERIFY_IDENTITY&ssl-ca=/etc/sql_exporter/yc-cert.crt

Cloud say this for golang

package main

import (
  "io/ioutil"
  "crypto/tls"
  "crypto/x509"
  "database/sql"
  "fmt"
  "github.com/go-sql-driver/mysql"
)

const (
  host     = "host"
  port     = 3306
  user     = "user"
  password = "password"
  dbname   = "dbname"
)

func main() {
  rootCertPool := x509.NewCertPool()
  pem, err := ioutil.ReadFile("/home/directory/.mysql/root.crt")
  if err != nil {
    panic(err)
  }
  if ok := rootCertPool.AppendCertsFromPEM(pem); !ok {
    panic("Failed to append PEM.")
  }

  mysql.RegisterTLSConfig("custom", &tls.Config{
    RootCAs: rootCertPool,
  })

  mysqlInfo := fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?tls=custom",
    user, password, host, port, dbname)
  conn, err := sql.Open("mysql", mysqlInfo)
  if err != nil {
    panic(err)
  }

  defer conn.Close()

  q, err := conn.Query("SELECT version()")
  if err != nil {
    panic(err)
  }

  var result string

  for q.Next() {
   q.Scan(&result)
   fmt.Println(result)
  }
}

[burningalchemist]

@Xolog Ah so you're with MySQL... I see. Well, golang mysql driver devs deliberately decided not to include the option to pass the tls certs via the query params, unlike PostgreSQL and the other. It requires a pre-registered TLSConfig struct to refer to, as you put it in the example.

I'll see what I can do here, but most likely it will mimic the existing configuration way through DSN params.

[burningalchemist]

Hey @Xolog, the feature is implemented under fix/mysql-tls branch. I'd need to spin up some infrastructure and configure it to test the feature on my end. So if in the meantime you're able to build/test it as well, that'd be appreciated. 👍

The connection string follows below:

mysql://{{ db_user }}:{{ db_password }}@{{ db_url }}:3306/{{db_name}}?tls=custom&tls-ca=/etc/sql_exporter/yc-cert.crt

It's also possible to add client certificates with optional tls-cert and tls-key parameters.

---

Seems to work fine on my end:

time=2026-02-20T23:26:16.483+01:00 level=WARN source=main.go:99 msg="Starting SQL exporter" versionInfo="(version=0.19.1, branch=fix/mysql-tls, revision=b7d316836011b0dc159b9b606d9962d0269ad091)" buildContext="(go=go1.26.0, platform=darwin/arm64, user=username@hostname, date=20260220-22:22:20, tags=netgo)"
time=2026-02-20T23:26:16.483+01:00 level=DEBUG source=config.go:37 msg="Loading configuration" file=sql_user.yml
time=2026-02-20T23:26:16.484+01:00 level=DEBUG source=config.go:190 msg="External collector files found" count=1 glob=examples/mssql/*.collector.yml
time=2026-02-20T23:26:16.484+01:00 level=DEBUG source=config.go:240 msg="Loaded collector" name=mssql_standard file=examples/mssql/mssql_standard.collector.yml
time=2026-02-20T23:26:16.484+01:00 level=DEBUG source=util.go:46 msg="Resolved collectors" context="job \"mysql\"" count=1
time=2026-02-20T23:26:16.484+01:00 level=DEBUG source=target.go:70 msg="target ping enabled" logContext="job=mysql,target=my1" enabled=true
time=2026-02-20T23:26:16.485+01:00 level=INFO source=tls_config.go:354 msg="Listening on" address=[::]:9399
time=2026-02-20T23:26:16.485+01:00 level=INFO source=tls_config.go:357 msg="TLS is disabled." http2=false address=[::]:9399
time=2026-02-20T23:26:28.015+01:00 level=DEBUG source=tls_mysql.go:33 msg="TLS Parameters" tls-ca=ca-cert.pem tls-cert=client-cert.pem tls-key=client-key.pem
time=2026-02-20T23:26:28.017+01:00 level=DEBUG source=sql.go:76 msg="Database handle successfully opened" logContext="job=mysql,target=my1" driver=mysql
time=2026-02-20T23:26:28.030+01:00 level=DEBUG source=query.go:131 msg="Query execution time" logContext="job=mysql,target=my1,collector=performance,query=threads" duration=2.160417ms
time=2026-02-20T23:26:28.030+01:00 level=DEBUG source=query.go:163 msg="Returned columns" logContext="job=mysql,target=my1,collector=performance,query=threads" columns=[threads_connected]

I'll give it some time to settle before merging. 👍

[burningalchemist]

@Xolog the feature was merged to master, feel free to build and use it. I'll release a new version with container images and binaries by the end of the week or so. 👍