phpMyAdmin with SSL (HTTPS and mysql client) on Nginx

Question

I'm setting up phpMyAdmin over SSL (HTTPS) and also SSL connections to database servers.

I've configured Nginx with SSL certificates. I've commented out the version check on phpMyAdmin as it was connecting via HTTP and breaking secure connection.

All database servers are SSL enabled:

Variable_name   Value
have_openssl    YES
have_ssl    YES
ssl_ca  /etc/mysql/ca-cert.pem
ssl_capath  
ssl_cert    /etc/mysql/server-cert.pem
ssl_cipher  
ssl_key /etc/mysql/server-key.pem

I've added the directive $cfg['Servers'][$i]['ssl'] = TRUE; to phpMyAdmin config file but I haven't specified paths to certs/keys, values:

$cfg['Servers'][$i]['ca'] = '/etc/ssl/certs/ca-cert.pem'; 
$cfg['Servers'][$i]['cert'] = '/etc/mysql/client-cert.pem'; 
$cfg['Servers'][$i]['key'] = '/etc/mysql/client-key.pem';

• however it looks like I'm using SSL connections between web server and database servers:

QUESTIONS:

1. Could you please help me to understand how this works without certificates on the webserver and if I'm actually using encrypted connection to db servers? Is it possible that it's cached somewhere as I've enabled these directives for a moment?

2. I've also noticed strange behaviour:

When I logged in to PMA I see the following URL:

https://example.com/index.php?token=e683bf8b717275f509cc76716c8db605#PMAURL:server=1&target=main.php&token=e683bf8b717275f509cc76716c8db605

• when I remove the long string and access the FQDN only (example.com) by pressing enter, the server logged me off however when I add some random string (example.com/sdfsfefse) - enter, I'm logged in without specifying password. Is it something to do with cookies?

Thank you

Answer 1

You don't set an SSL certificate for phpMyAdmin for HTTPS - it is a web app - not a web server. Nginx stores the certificates and terminates/unwraps the SSL.

The HTTPS session you are using is between your PC and Nginx - it is nothing to do with phpMyAdmin. Your phpMyAdmin vhost is using whatever certificate you defined in Nginx.

HTTPS != SSL insofar as phpMyAdmin's configuration is concerned.

The setting you referred to is specifically for an SSL connection between phpMyAdmin and MySQL - which if is on localhost, isn't all too relevant anyway.

The token in the URL is normal for phpMyAdmin to store your session. Remove it, and lose your session.