Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up a local webapp. I have a CentOS-5 box that will be the webserver (Apache 2.2). I have another box (RHEL5) that will be used only for MySQL.

The data will be encrypted on the webserver via PHP before being sent to the MySQL box and inserted into the db. All web-based connections to the webserver will be encrypted via SSL.

From the research I've done, it's not totally clear on whether or not there is a need to encrypt the connection to the db from webserver (NB paranoia level: Orange).

If it is not overkill, or even if it is (unless it is a really bad idea for some reason), any advice or pointers on the direction to take to get this done would be appreciated.

share|improve this question
up vote 4 down vote accepted


share|improve this answer

I wouldn't consider it overkill and would consider it well advised. Nevertheless, it is not a replacement for proper network segmentation.

While stunnel is a perfectly acceptable solution, you might have better luck using MySQL's native SSL support.

share|improve this answer
Thanks for the post. I looked into the native SSL support -- and it looks promising. However, I remembered today that I will also be storing files on the MySQL database server (outside of the db), so stunnel looks to be a better fit in this case. Thanks again! – stormdrain May 20 '10 at 1:00
What does storing files outside of the db have to do with stunnel? – Warner May 20 '10 at 14:39
The files will be on the same machine outside the db, so stunnel will work both for that and connecting to the db. – stormdrain Jun 2 '10 at 17:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.