0

I was installing a renewed SSL cert on my web servers and noticed that my DB server doesn't have one set up, which got me wondering:

  • Should my database server only accept connections via SSL?

The database server is not web accessible, so I'm not sure it matters. Just wondering if I'm committing a faux pas by not having my PHP web servers talk to the database (MySQL) over SSL.

3

Are you connecting to your database server using only your loopback interface ? If so, SSL is useless.

If you are using your database over some network, it could be useful to use SSL to avoid eavesdropping, since your databases queries/answers can carries useful/personal data.

  • I'm not sure what you mean by a loopback interface..? The web server and database server are not the same machine, if that's a partial answer to the question. They are at the same co-lo, however. – Anthony Jul 2 '13 at 20:15
  • Then you are having sql traffic going through your network. The use of SSL will avoid the possibility of eavesdropping on that network. "loopback interface" was meaning web & sql server on the same host, thus php accessing to your database via localhost/127.0.0.1/::1 – user2299634 Jul 2 '13 at 21:21
  • Ok, makes sense! Just making sure I'm aware of the risks. – Anthony Jul 3 '13 at 13:21
1

If you have information on the server that you don't want to fall into the wrong hands (like credit card information for shopping cart sites and things like that) you should get an SSL for the server. It's easier and cheaper to set up an SSL than to repair your businesses reputation or repair the damage from losing your data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.