Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm setting up phpMyAdmin over SSL (HTTPS) and also SSL connections to database servers.

I've configured Nginx with SSL certificates. I've commented out the version check on phpMyAdmin as it was connecting via HTTP and breaking secure connection.

All database servers are SSL enabled:

Variable_name   Value
have_openssl    YES
have_ssl    YES
ssl_ca  /etc/mysql/ca-cert.pem
ssl_capath  
ssl_cert    /etc/mysql/server-cert.pem
ssl_cipher  
ssl_key /etc/mysql/server-key.pem

I've added the directive $cfg['Servers'][$i]['ssl'] = TRUE; to phpMyAdmin config file but I haven't specified paths to certs/keys, values:

$cfg['Servers'][$i]['ca'] = '/etc/ssl/certs/ca-cert.pem'; 
$cfg['Servers'][$i]['cert'] = '/etc/mysql/client-cert.pem'; 
$cfg['Servers'][$i]['key'] = '/etc/mysql/client-key.pem';
  • however it looks like I'm using SSL connections between web server and database servers:

enter image description here

QUESTIONS:

  1. Could you please help me to understand how this works without certificates on the webserver and if I'm actually using encrypted connection to db servers? Is it possible that it's cached somewhere as I've enabled these directives for a moment?

  2. I've also noticed strange behaviour:

When I logged in to PMA I see the following URL:

https://example.com/index.php?token=e683bf8b717275f509cc76716c8db605#PMAURL:server=1&target=main.php&token=e683bf8b717275f509cc76716c8db605
  • when I remove the long string and access the FQDN only (example.com) by pressing enter, the server logged me off however when I add some random string (example.com/sdfsfefse) - enter, I'm logged in without specifying password. Is it something to do with cookies?

Thank you

share|improve this question

1 Answer 1

up vote 1 down vote accepted

You don't set an SSL certificate for PHPMyAdmin for HTTPS - it is a web app - not a web server. Nginx stores the certificates and terminates/unwraps the SSL.

The HTTPS session you are using is between your PC and Nginx - it is nothing to do with PHPMyAdmin. Your PHPMyAdmin vhost is using whatever certificate you defined in Nginx.

HTTPS != SSL sofaras PHPMyAdmin's configuration is concerned.

The setting you referred to is specifically for an SSL connection between PHPMyAdmin and MySQL - which if is on localhost, isn't all too relevant anyway.

The token in the URL is normal for PHPMyAdmin to store your session. Remove it, and lose your session.

share|improve this answer
    
The HTTPS works fine. I do have database servers on different physical machines and I'm wondering why it's working even if I didn't specified paths to certs/keys and the user that I'm connecting with has "REQUIRE SQL" enabled. Is the client and database servers exchange the key like web browsers and that's why I don't need certs on the web server? –  HTF Jun 28 '12 at 11:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.