Edit report at https://bugs.php.net/bug.php?id=71003&edit=1
ID: 71003
Comment by: zhil dot mobile at gmail dot com
Reported by: tmatsuo at google dot com
Summary: Expose MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT to
PDO interface
Status: Assigned
Type: Feature/Change Request
Package: PDO MySQL
PHP Version: 5.6.16
Assigned To: andrey
Block user comment: N
Private report: N
New Comment:
I have setuped free SSL sertificate from http://buy.wosign.com/free/
It works on SSH console using mysql command like
mysql -h myhost.com --ssl --ssl-ca=/.../wosign/root_bundle.crt --ssl-verify-server-cert
--ssl-mode=REQUIRED DBNAME -u USERNAME -pPASS
But I failed to make it work using php PDO mysql.
I am considering creating SSH tunel for remote mysql instead of spending more time on this issue.
Do anybody have any ideas how could it be fixed?
Previous Comments:
------------------------------------------------------------------------
[2016-05-18 17:52:51] nikic@php.net
@andrey: You implemented the mysqli fix for this issue, could you maybe take a look at PDO mysql as
well?
------------------------------------------------------------------------
[2016-05-18 16:55:31] highmind63 at gmail dot com
For all those trying to get this to work, don't. There is no possible way to make this work, in
all of my tests. You MUST have a valid commercial certificate and it MUST match the name of the
host. I've tried the following to no avail:
set PDO::MYSQL_ATTR_SSL_CAPATH option to a properly hashed dir (one that I tested and works with
CURLOPT_CAPATH). No go
set openssl.capath to the same properly hashed dir. No go, completely ignored.
I tried fiddling around a bit with openssl's internal cert store, but I couldn't get that
to work. That should work, but at the expense of changing all the openssl cert store data
system-wide.
This is a big defect in PHP's PDO currently, PDO over SSL is barely useable as-is.
------------------------------------------------------------------------
[2016-05-18 02:05:16] requinix@php.net
See also bug #71845 about the general CN mismatch problem.
------------------------------------------------------------------------
[2016-05-18 02:04:09] requinix@php.net
Related To: Bug #71845
------------------------------------------------------------------------
[2016-05-18 02:02:50] requinix@php.net
Related To: Bug #72235
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=71003
--
Edit this bug report at https://bugs.php.net/bug.php?id=71003&edit=1