如何使用PHP / PDO从Ubuntu创建到SQL Server的加密连接

Question

I'm trying to connect to an SQL Server from a PHP/Zend Framework application running on Ubuntu and at a remote location.

I'm trying to get the connecting application to request encryption from the SQL Server (since the default connection on 1433 is in the clear, and I don't want my credentials being sniffed).

I've configured the wildcard SSL certificate on the SQL Server, and I'm creating a PDO connection with the following DSN:

dblib:host=server-not-matching-domain.com:1433;dbname=MyDB;Encrypt=true;TrustServerCertificate=false;charset=

Taken from http://blogs.msdn.com/b/brian_swan/archive/2011/03/08/sql-server-driver-for-php-connection-options-encrypt.aspx

Since the host name doesn't match the installed certificate, I'd expect the connection to fail - but it doesn't fail.

Answer 1

Might it be that Encrypt=true;TrustServerCertificate are not taken under consideration at all? Without being an expert on this please check out the documentation in PHP regarding PDO_DBLIB DSN . As written there is a special parameter in the DSN that is called secure and is currently unused. I am not sure if this is supposed to be the correct way of declaring that you want a secure connection in this DSN and it is also not helpful at all the fact that it is tagged as unused .

In addition also do the following

In php.ini make sure the following is set: mssql.secure_connection = On

Have a look if connecting via PDO_ODBC is better for what you want to achieve. For connecting via PDO_ODBC check out this example

Answer 2

try to install AES ENCRYPTION CERTIFICATE it's the best i have used to protect credentials from being sniffed

dblib:host=server-not-matching-domain.com:1433;dbname=MyDB;Encrypt=true;TrustServerCertificate=true;charset=utf8

make the default value true of ssl crtificate in php.ini file and then procede with AES

Answer 3

It is a more complicated than just setting up a flag.

Refer this blog: http://www.madirish.net/214

1. You will have to create or install ssl certificate on mysql server.

2. in my.cnf do the below settings:

   ssl-ca=/etc/ssl/mysql/server.csr
   ssl-cert=/etc/ssl/mysql/server.cert
   ssl-key=/etc/ssl/mysql/server.key

3. restart mysql : mysqld restart

4. Create client keys

5. Send those keys along with username and password.

Following stackoverflow answers explain it in detail:

Connect to remote MySQL server with SSL from PHP

PHP to MySQL SSL Connections

Hope it helps.