使用 PHP 通过 SSL 将 AWS EC2 实例连接到 RDS MySQL

Question

I am unable to make my AWS EC2 instance connect to my RDS MySQL DB through SSL.

AWS EC2 Linux 2, Apache 2.4.39, PHP 7.3.10, MySQL 5.7.26. In order for my application that resides in EC2 to have a secure connection in transit, it must utilize SSL/TLS. My understanding that given my PHP/MySQL application, I need to perform the code below. In order not to affect my DB, I have set up a test DB. The new user is called new-user with its own password. I got the bundled PEM file rds-combined-ca-bundle.pem from https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem and placed it in a browser accessible directory on the EC2 server as directed by that AWS page.

Any ideas why "Unable to set private key file `rds-combined-ca-bundle.pem' " in the output?

**In AWS-test-ssl-script.php** ..

20 define ('MYSQLI', 'AWS-test-connect.php');

**In 'AWS-test-connect.php'** ..

12 $dbc=mysqli_init();
13 mysqli_ssl_set($dbc, NULL, "/dir/rds-combined-ca-bundle.pem", NULL, NULL, NULL);
14 mysqli_real_connect($dbc,"DB_server","new-user","password");

16 $res = mysqli_query($dbc, 'SHOW STATUS like "Ssl_cipher"');
17 print_r(mysqli_fetch_row($res));
18 mysqli_close($dbc);

**In AWS-test-ssl-script.php** ..

35 require(MYSQLI);

44 $sel = "CREATE USER IF NOT EXISTS 'new-user'@'%' IDENTIFIED BY 'password' REQUIRE SSL";
45 $sel_qry = mysqli_query($dbc, $sel);
46 mysqli_close($sel_qry);

48 $grant = "GRANT SELECT, INSERT, UPDATE, DELETE
49 ON testdb
50 TO new-user@%";
51 $grant_qry = mysqli_query($dbc, $grant);
52 mysqli_close($grant_qry);```

Output ..
Warning: mysqli_real_connect(): Unable to set private key file `rds-combined-ca-bundle.pem' in AWS-test-connect.php on line 14
Warning: mysqli_real_connect(): Cannot connect to MySQL by using SSL in AWS-test-connect.php on line 14
plus other warnings.

Answer 1

It's a PHP mysqli_real_connect() error reporting that the specified SSL key cannot be found.

That key is referenced in this statement on line 13:

 mysqli_ssl_set($dbc, NULL, "/dir/rds-combined-ca-bundle.pem", NULL, NULL, NULL);

That message suggests that key file does not exist, or has incorrect permissions. Can you confirm that file is accessible in that directory?

You could also turn off SSL if it's not crucial and see if that works.