From ff014ac34deb44c277c52744758479bb937b3c4a Mon Sep 17 00:00:00 2001 From: Joel Hutchinson Date: Sat, 9 Jan 2016 09:10:40 -0600 Subject: [PATCH 1/2] Added the new SSL check disable flag MySQL 5.6 or later requests peer_name validation of the SSL. This causes most self signed certificates to fail validation. In PMA, you only get a vague 2002 connection error as a result. As of PHP 5.6.16, a new flag exists to disable the check and allows the connection to proceed. See https://bugs.php.net/bug.php?id=68344 and #11838 Signed-off-by: Joel Hutchinson joel.hutchinson@onlinecommercegroup.com --- doc/config.rst | 14 ++++++++++++++ libraries/config.default.php | 11 +++++++++++ libraries/dbi/DBIMysqli.php | 11 ++++++++++- 3 files changed, 35 insertions(+), 1 deletion(-) diff --git a/doc/config.rst b/doc/config.rst index f9b5e137b2..475561fe77 100644 --- a/doc/config.rst +++ b/doc/config.rst @@ -290,6 +290,20 @@ Server connection settings List of allowable ciphers for SSL connections to the MySQL server. +.. config:option:: $cfg['Servers'][$i]['ssl_verify'] + + :type: boolean + :default: true + + If your PHP install uses the MySQL Native Driver (mysqlnd), your + MySQL server is 5.6 or later, and your SSL certificate is self-signed, + there is a chance your SSL connection will fail due to validation. + Setting this to ``false`` will disable the validation check. + + .. note:: + + This flag only works with PHP 5.6.16 or later + .. config:option:: $cfg['Servers'][$i]['connect_type'] :type: string diff --git a/libraries/config.default.php b/libraries/config.default.php index d49d593dc5..a0764651b1 100644 --- a/libraries/config.default.php +++ b/libraries/config.default.php @@ -180,6 +180,17 @@ $cfg['Servers'][$i]['ssl_ca_path'] = null; */ $cfg['Servers'][$i]['ssl_ciphers'] = null; +/** + * MySQL 5.6 or later triggers the mysqlnd driver in PHP to validate the + * peer_name of the SSL certifcate + * For most self-signed certificates this is a problem. Setting this to false + * will disable the check and allow the connection (PHP 5.6.16 or later) + * + * @link http://bugs.php.net/68344 + * @global string $cfg['Servers'][$i]['ssl_verify'] + */ +$cfg['Servers'][$i]['ssl_verify'] = true; + /** * How to connect to MySQL server ('tcp' or 'socket') * diff --git a/libraries/dbi/DBIMysqli.php b/libraries/dbi/DBIMysqli.php index dd973a465c..b0d55780de 100644 --- a/libraries/dbi/DBIMysqli.php +++ b/libraries/dbi/DBIMysqli.php @@ -158,7 +158,16 @@ class DBIMysqli implements DBIExtension $cfg['Server']['ssl_ca_path'], $cfg['Server']['ssl_ciphers'] ); - $client_flags |= MYSQLI_CLIENT_SSL; + $ssl_flag = MYSQLI_CLIENT_SSL; + /* + * disables SSL certificate validation on mysqlnd for MySQL 5.6 or later + * @link https://bugs.php.net/bug.php?id=68344 + * @link https://github.com/phpmyadmin/phpmyadmin/pull/11838 + */ + if(!$cfg['Server']['ssl_verify'] && defined('MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT')) { + $ssl_flag = MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT; + } + $client_flags |= $ssl_flag; } if (! $server) { From 8db478c4033442d3728e25382077487e52a096a7 Mon Sep 17 00:00:00 2001 From: Isaac Bennetch Date: Fri, 15 Jan 2016 16:38:33 -0500 Subject: [PATCH 2/2] ChangeLog entry for new ssl_verify directive Signed-off-by: Isaac Bennetch --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index bf2d1c622b..9d5e6e7eb9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -33,6 +33,7 @@ phpMyAdmin - ChangeLog + issue #11833 Drop support for old Internet Explorer versions + issue #11796 Use modals for displaying forms in db structure page + issue #11789 Show MySQL error messages in user language ++ issue Add 'ssl_verify' configuration directive for self-signed certificates with mysqlnd and PHP >= 5.6 4.5.4.0 (not yet released) - issue #11724 live data edit of big sets is not working