Cannot Access AWS RDS MySQL + PHP on Heroku

Question

I'm trying to move my application to Heroku but I'm having problems accessing the database via PHP. I'm able to access the AWS database from my machine locally, but when I deploy to Heroku it fails.

I've followed directions from the main page: https://devcenter.heroku.com/articles/amazon-rds

And I've tried other threads on SO/AWS:

Getting Mysql2::Error (SSL connection error: ASN: bad other signature confirmation) on Heroku App with AWS RDS

http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_MySQL.html#MySQL.Concepts.SSLSupport

I also saw instructions here: https://devcenter.heroku.com/articles/getting-started-with-php#provision-a-database

But I'm trying to port an existing application so I need to stick with my existing PDO syntax. I'm trying to get this to work:

$dbInfo = getenv('DATABASE_URL');
try{
    $dbh = new PDO($dbInfo);
    echo json_encode(array('outcome' => true));
}
catch(PDOException $ex){
    echo json_encode(array('outcome' => false, 'message' => 'Unable to connect'));
}

I have the environmental variable setup properly and can run parse_url to access all of the array items; I also have the amazon-rds-ca-cert.pem located in the config folder.

I'm able to login remotely (via SequelPro) and have run the following in the query manager to try to force SSL cert:

GRANT USAGE ON *.* TO 'username'@'%' REQUIRE SSL;

But when I intentionally misspell the cert name my local database can still connect, which makes me think maybe I am missing something with the requirement.

Answer 1

Figured it out; needed to manually specify the SSL certificate within the PDO connection. Also had minor errors in the PDO syntax.

try{
  $dbh = new PDO("mysql:host=$pdohost;dbname=$pdodb", $pdouser, $pdopass, array(
    PDO::MYSQL_ATTR_SSL_CA    =>'path/to/combined-cert.pem'
  ));
  echo json_encode(array('outcome' => true));
}
catch(PDOException $ex){
  echo $ex;
  echo json_encode(array('outcome' => false, 'message' => 'Unable to connect'));
}

Also needed to be sure to update the AWS inbound rules to 0.0.0.0/0 to allow for Heroku to access.