From: 2ce27k7518ek at opayq dot com
Operating system: any
PHP version: 7.2.7
Package: PDO MySQL
Bug Type: Bug
Bug description:SSL fails w/EC crt: "PDO::__construct(): this stream does not support SSL/crypt
Description:
------------
It's not possible to use elliptic curve certs/ciphers for SSL pdo_mysql
connection
Actual result:
--------------
I'm running php 7.2.7 on linux
php -v
PHP 7.2.7-dev (cli) (built: Jun 23 2018 08:57:14) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies
with Zend OPcache v7.2.7-dev, Copyright (c) 1999-2018, by Zend
Technologies
pdo exts are built with config
--enable-pdo=shared
--enable-mysqlnd=shared
--enable-mysqlnd-compression-support
--with-mysqli=shared,mysqlnd
--with-pdo-mysql=shared,mysqlnd
--with-mysql-sock=/var/cache/mariadb/mariadb.sock
openssl is
openssl version
OpenSSL 1.1.0h 27 Mar 2018
sql/ssl extensions loaded include
php -m |egrep "pdo|ssl|sql"
mysqli
mysqlnd
openssl
pdo_mysql
pdo_sqlite
sqlite3
My DB is
mariadb_config --version --tlsinfo --socket
10.3.8
OpenSSL 1.1.0h
/var/cache/mariadb/mariadb.sock
I use driver == pdo_mysql for connections in a Symfony4+Doctrine app.
Without SSL, connections work as expected -- both from within app via
pdo, and from shell using native mysql client
Adding SSL to the mix, from shell using native mysql client, works
mysql \
-h localhost \
-u ${DBUSER} \
--password=${DBPASS} \
--ssl-ca=${SSL_CA_CERT} \
--ssl-cert=${SSL_CERT} \
--ssl-key=${SSL_PRIVKEY} \
--ssl-cipher=${SSL_CIPHERS} \
--ssl-verify-server-cert \
${DBNAME}
MariaDB [testdb]> status;
--------------
mysql Ver 15.1 Distrib 10.3.8-MariaDB, for Linux (x86_64) using
readline 5.1
Connection id: 16
Current database: testdb
Current user: testuser@localhost
SSL: Cipher in use is
ECDHE-ECDSA-CHACHA20-POLY1305
Current pager: /usr/bin/less
Using outfile: ''
Using delimiter: ;
Server: MariaDB
Server version: 10.3.8-MariaDB-log Source distribution
Protocol version: 10
Connection: Localhost via UNIX socket
Server characterset: utf8mb4
Db characterset: utf8mb4
Client characterset: utf8mb4
Conn. characterset: utf8mb4
UNIX socket: /var/cache/mariadb/mariadb.sock
Uptime: 54 min 34 sec
Threads: 8 Questions: 27 Slow queries: 0 Opens: 17 Flush tables: 1
Open tables: 11 Queries per second avg: 0.008
--------------
But, using same ENV (certs, privkey, cipherspec), with key config in PHP
app,
!php/const:PDO::MYSQL_ATTR_SSL_CA: '%env(SSL_CA_CERT)%'
!php/const:PDO::MYSQL_ATTR_SSL_CERT: '%env(SSL_CERT)%'
!php/const:PDO::MYSQL_ATTR_SSL_KEY: '%env(SSL_PRIVKEY)%'
!php/const:PDO::MYSQL_ATTR_SSL_CIPHER: '%env(SSL_CIPHERS)%'
on attempt to connect from within app, e.g., on exec of
bin/console doctrine:phpcr:init:dbal --force
fails, returning
In AbstractMySQLDriver.php line 112:
An exception occurred in driver: SQLSTATE[HY000] [2002]
In PDOConnection.php line 50:
SQLSTATE[HY000] [2002]
In PDOConnection.php line 46:
SQLSTATE[HY000] [2002]
In PDOConnection.php line 46:
PDO::__construct(): this stream does not support SSL/crypto
The notable error being
"PDO::__construct(): this stream does not support SSL/crypto"
Digging around, this is apparently due to a lack of EC support in
pdo_mysql.
My certs/keys are EC, and my cipher spec is limited to
SSL_CIPHERS='ECDHE-ECDSA-CHACHA20-POLY1305'
which is widely/consistently used across all our internal servers &
services.
Apparently, EC support was added long ago for ext/openssl
Request #61204 Add elliptic curve support for OpenSSL
https://bugs.php.net/bug.php?id=61204--
Edit bug report at https://bugs.php.net/bug.php?id=76575&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=76575&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=76575&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=76575&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=76575&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=76575&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=76575&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=76575&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=76575&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=76575&r=support
Expected behavior: https://bugs.php.net/fix.php?id=76575&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=76575&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=76575&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=76575&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=76575&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=76575&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=76575&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=76575&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=76575&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=76575&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=76575&r=mysqlcfg