2

I primarily develop PHP applications using MySQL as my database. Generally, the server running the application is on the same box as the MySQL server, though not always.

I was reading in the PHP docs about SSL support http://php.net/manual/en/ref.pdo-mysql.php and I'm left with these questions:

  1. With the application and database server being in the same (localhost) environment, is it necessary to connect to MySQL using SSL?
  2. Is the benefit of this for when you're accessing information between two servers (application server & a database server)?
  3. What are "best-practices" for using a PDO-SSL connection?
  4. Is it safe to assume that using an SSL certificate for the client/server connection has nothing to do with PDO's SSL connection?

2 Answers 2

2

1) Not in most circumstances - you can(should) configure MySQL to be local only so unless someone has admin access to the box or is able to run as the MySQL user the SSL won't make a difference.

2) Absolutely, it prevents man in the middle (someone spoofing your webserver so they can query the database for instance) and sniffing data.

3)Same as with most SSL - use strong encryption (no SHA1), guard your keys, change them regularly etc.

4) Sort of, they don't need to be the same keys or anything but if your organization has a CA then you can simplify things but getting them to approve ("sign") your certificates which could make things simpler from a management point of view.

0

With the application and database server being in the same (localhost) environment, is it necessary to connect to MySQL using SSL?

No. You're best of using the MySQL socket anyway which doesn't support SSL/TLS regardless.

Is the benefit of this for when you're accessing information between two servers (application server & a database server)?

Yes. SSL/TLS provides transport security ensuring that neither the credentials nor the transactions are transmitted in clear text. Traditional thinking is that in a trusted network the risk of eavesdropping by a malicious third party is extremely slim and the benefits of securing such traffic are negligible compared to the overhead. That is shifting though, the overhead isn't that big and better safe than sorry...

3
  • How would you go about determining the overhead of the connection?
    – thebarless
    Mar 30, 2016 at 19:58
  • In addition to the normal SYN-ACK-ACK toundtrip to establish the TCP connection you get a couple of round trips to agree on the encryption keys
    – HBruijn
    Mar 30, 2016 at 20:04
  • + the added float point stuff done for the encryption - shouldn't be a big deal unless the server is bogged down (then CPU will get stressed) or you are doing a MASSIVE amount of SQL traffic (CPU again but we're talking 100's of meg a second transfer before it's a real issue). That's assuming you are encrypting, it may be possible to just authenticate the MySQL connection with SSL but not encrypt the data, I have not tried. It's not an issue in most circumstances. Mar 30, 2016 at 20:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .