How to create *encrypted* connection to remote MySQL server using PDO?

How to create encrypted connection to remote MySQL server using PDO?

sneakyimp

OK I see in the MySQL documentation that it's possible to grant privileges that require an SSL connection and I also see that one can connect with specific certs. However, I have been unable to find any detailed PHP docs on how to connect with a specific cert/key/ca/capath.

The first user comment on this page hints that some recent version of PHP supports certs, but it doesn't describe which version.

Sadly, I know little about generating certs beyond what I've been told explicitly to do by various server setup how-tos. I do know that I will probably not have the luxury of a valid certificate so I'll need this to work with a home-rolled cert.

Any and all advice about how to get this rolling would be much appreciated.

bradgrafelman

Are you limited to using PDO? MySQLi also supports using SSL certificates to connect to secure MySQL servers.

EDIT: Also..

sneakyimp wrote:
it doesn't describe which version.

Sure it does - it's the first thing mentioned in that comment:

curt at webmasterbond dot com wrote:
16-Apr-2011 12:54

Today's PHP snapshot now has SSL support for PDO.

(emphasis added).

sneakyimp

Hm. I see that PHP 5.3.6 (the latest) was released on March 17th (which predates the post of April 16). I suppose this means that PDO does not support SSL connections in 5.3.3 which is the version available by default with Ubuntu 10.10. Using the latest snapshot in a production environment sounds like a bad idea.

I could use MySQLi I suppose but I'd have to rewrite all my database access stuff which currently uses PDO 🙁

bradgrafelman

sneakyimp wrote:
Using the latest snapshot in a production environment sounds like a bad idea.

shrug It's your call. You're right, though; using bleeding-edge snapshots in production is not a normal recommendation. However, if there is a feature that isn't available unless you do so (I looked in the source for 5.3.6 - it's not in there either), then that's a judgment call you'll have to make.

Note, however, that PHP has an extensive(?) testing package distributed with the source, so if you did decide to compile the latest version you can at least run the tests to ensure that things haven't been broken and whatnot.