Zabbix server / proxyfails to connect to Oracle MySQL 8.0 / 8.4 when using mariadb-connector-c 3.4.x:

TLS/SSL error: self-signed certificate in certificate chain)

Starting with mariadb-connector-c 3.4.x, the connector changed its default TLS behavior:

• TLS is effectively enabled by default.
• Server certificate verification is enabled by default (equivalent to MYSQL_OPT_SSL_VERIFY_SERVER_CERT = 1 / peer verification on).

On systems where Zabbix dynamically links against this newer connector:

• If the MySQL server uses a self-signed certificate or an internal CA that is not trusted by the OS trust store, the connector rejects the TLS handshake with:

  self-signed certificate in certificate chain

• This is not a change in Zabbix itself, but from the perspective of the user it appears as a regression after an OS / library update.

Why this matters:

• Many users deploy Zabbix on top of distro packages and rely on dynamic linking against the system libmariadb.
• When the OS silently updates mariadb-connector-c to 3.4.x (Alpine 3.23, newer Fedora, Arch, etc.), Zabbix can suddenly lose DB connectivity to existing MySQL installations using self-signed or internal CA certificates.
• Without clear guidance or configurable knobs from the Zabbix side, this looks like “Zabbix randomly stopped talking to MySQL after OS update” and is non-trivial to diagnose.

Currently the issue is related only to recently released Alpine 3.23, but in near future the problem can be much more actual on other distro. The issue is not affected for installations, which use DB socket!