Connect AWS EC2 instance to RDS MySQL through SSL using PHP

Question

I am unable to make my AWS EC2 instance connect to my RDS MySQL DB through SSL.

AWS EC2 Linux 2, Apache 2.4.39, PHP 7.3.10, MySQL 5.7.26. In order for my application that resides in EC2 to have a secure connection in transit, it must utilize SSL/TLS. My understanding that given my PHP/MySQL application, I need to perform the code below. In order not to affect my DB, I have set up a test DB. The new user is called new-user with its own password. I got the bundled PEM file rds-combined-ca-bundle.pem from https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem and placed it in a browser accessible directory on the EC2 server as directed by that AWS page.

Any ideas why "Unable to set private key file `rds-combined-ca-bundle.pem' " in the output?

**In AWS-test-ssl-script.php** ..

20 define ('MYSQLI', 'AWS-test-connect.php');

**In 'AWS-test-connect.php'** ..

12 $dbc=mysqli_init();
13 mysqli_ssl_set($dbc, NULL, "/dir/rds-combined-ca-bundle.pem", NULL, NULL, NULL);
14 mysqli_real_connect($dbc,"DB_server","new-user","password");

16 $res = mysqli_query($dbc, 'SHOW STATUS like "Ssl_cipher"');
17 print_r(mysqli_fetch_row($res));
18 mysqli_close($dbc);

**In AWS-test-ssl-script.php** ..

35 require(MYSQLI);

44 $sel = "CREATE USER IF NOT EXISTS 'new-user'@'%' IDENTIFIED BY 'password' REQUIRE SSL";
45 $sel_qry = mysqli_query($dbc, $sel);
46 mysqli_close($sel_qry);

48 $grant = "GRANT SELECT, INSERT, UPDATE, DELETE
49 ON testdb
50 TO new-user@%";
51 $grant_qry = mysqli_query($dbc, $grant);
52 mysqli_close($grant_qry);```

Output ..
Warning: mysqli_real_connect(): Unable to set private key file `rds-combined-ca-bundle.pem' in AWS-test-connect.php on line 14
Warning: mysqli_real_connect(): Cannot connect to MySQL by using SSL in AWS-test-connect.php on line 14
plus other warnings.

@Shohag Monzur Using the code you referenced got the warning: Warning: mysqli::real_connect(): SSL operation failed with code 1. OpenSSL Error messages: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed in /path/AWS-test-connect.php on line 14 — krot

Rodrigo M Rodrigo M · Accepted Answer · 2020-01-11T17:02:22

It's a PHP mysqli_real_connect() error reporting that the specified SSL key cannot be found.

That key is referenced in this statement on line 13:

 mysqli_ssl_set($dbc, NULL, "/dir/rds-combined-ca-bundle.pem", NULL, NULL, NULL);

That message suggests that key file does not exist, or has incorrect permissions. Can you confirm that file is accessible in that directory?

You could also turn off SSL if it's not crucial and see if that works.

Connect AWS EC2 instance to RDS MySQL through SSL using PHP

1 Answers