Mysql – What are the benefits of connecting to MySQL using PHP-PDO’s SSL attribute

MySQLpdoPHPssl

I primarily develop PHP applications using MySQL as my database. Generally, the server running the application is on the same box as the MySQL server, though not always.

I was reading in the PHP docs about SSL support http://php.net/manual/en/ref.pdo-mysql.php and I'm left with these questions:

With the application and database server being in the same (localhost) environment, is it necessary to connect to MySQL using SSL?
Is the benefit of this for when you're accessing information between two servers (application server & a database server)?
What are "best-practices" for using a PDO-SSL connection?
Is it safe to assume that using an SSL certificate for the client/server connection has nothing to do with PDO's SSL connection?

Best Answer

1) Not in most circumstances - you can(should) configure MySQL to be local only so unless someone has admin access to the box or is able to run as the MySQL user the SSL won't make a difference.

2) Absolutely, it prevents man in the middle (someone spoofing your webserver so they can query the database for instance) and sniffing data.

3)Same as with most SSL - use strong encryption (no SHA1), guard your keys, change them regularly etc.

4) Sort of, they don't need to be the same keys or anything but if your organization has a CA then you can simplify things but getting them to approve ("sign") your certificates which could make things simpler from a management point of view.

Related Solutions

Mysql – Connecting to MySQL securely – MySQL’s SSL vs Stunnel vs SSH Tunneling

I would go with the ssh-tunnel and do it with autossh instead of ssh. About the performance I would say, that the SSH protocol is highly customizable and you could fine tune your connection, if needed.

But I would not expect a noticeable overhead after the connection is set up.

MySQL Connection Issue – Can’t Connect Using Self-Signed SSL

Yes, you are correct that if you don't specify --ssl-ca then the client does not check the server certificate at all. Since it works without that option the most likely reason for the failure is that the client doesn't trust the server certificate.

If you are using self-signed client and server certificates then the ca.cert file should include both these files. That way the client will trust the server certificate and the server will trust the client certificate.

For example:
Generate the server key and certificate:

$ openssl req -x509 -newkey rsa:1024 \
         -keyout server-key-enc.pem -out server-cert.pem \
         -subj '/DC=com/DC=example/CN=server' -passout pass:qwerty

$ openssl rsa -in server-key-enc.pem -out server-key.pem \
         -passin pass:qwerty -passout pass:

Generate the client key and certificate:

$ openssl req -x509 -newkey rsa:1024 \
         -keyout client-key-enc.pem -out client-cert.pem \
         -subj '/DC=com/DC=example/CN=client' -passout pass:qwerty

$ openssl rsa -in client-key-enc.pem -out client-key.pem \
         -passin pass:qwerty -passout pass:

Combine the client and server certificates into the CA certificates file:

$ cat server-cert.pem client-cert.pem > ca.pem

Best Answer

Related Solutions

Mysql – Connecting to MySQL securely – MySQL’s SSL vs Stunnel vs SSH Tunneling

MySQL Connection Issue – Can’t Connect Using Self-Signed SSL

Related Topic