title: PHP ignores ssl certificates when connecting to MySql
body: <p>Using the code from the PHP manual found <a href="http://php.net/manual/en/mysqli.real-connect.php" rel="nofollow noreferrer">here</a> and <a href="http://php.net/manual/en/mysqli.ssl-set.php" rel="nofollow noreferrer">here</a></p>
  
  <pre><code>&lt;?php
  
  $mysqli = mysqli_init();
  if (!$mysqli) {
      die('mysqli_init failed');
  }
  
  $mysqli-&gt;ssl_set('/path/to/client-key.pem',   
                   '/path/to/client-cert.pem',
                   '/path/to/ca-cert.pem',
                    NULL,NULL); //&lt;-- Doesn't matter if the paths are right or wrong
  
  if (!$mysqli-&gt;options(MYSQLI_INIT_COMMAND, 'SET AUTOCOMMIT = 0')) {
      die('Setting MYSQLI_INIT_COMMAND failed');
  }
  
  if (!$mysqli-&gt;options(MYSQLI_OPT_CONNECT_TIMEOUT, 5)) {
      die('Setting MYSQLI_OPT_CONNECT_TIMEOUT failed');
  }
  
  if (!$mysqli-&gt;real_connect('xx.xx.xx.xx', 'my_user', 'my_password', 'my_db')) {
      die('Connect Error (' . mysqli_connect_errno() . ') '
              . mysqli_connect_error());
  }
  
  echo 'Success... ' . $mysqli-&gt;host_info . "\n";
  
  $mysqli-&gt;close();
  ?&gt;
  </code></pre>
  
  <p>I'm unable to connect to MySql. It gives the following error:</p>
  
  <pre><code>Message: SQLSTATE[28000] [1045] Access denied for user 'my_user'@'xx.xx.xx.xx' (using password: YES) &lt;-- the client IP
  </code></pre>
  
  <p><strong>I have narrowed down the problem to the line <code>$mysqli-&gt;ssl_set(...)</code>.</strong></p>
  
  <p><strong>When I pass wrong paths to the certificates it should throw a <code>SSL certificate error</code> according to <a href="http://forums.phpfreaks.com/topic/216464-mysql-connect-error-1045-access-denied-with-ssl/#entry1125060" rel="nofollow noreferrer">this post</a> where the user suffered from the same problem instead it throws the same previous Access denied error.</strong></p>
  
  <p>I managed to make a connection using Navicat to the server with the help of the database admin by configuring the ssl connection as follows:
  <img src="https://i.stack.imgur.com/BUMKO.png" alt="enter image description here"></p>
  
  <p>Notes:</p>
  
  <ol>
  <li>My PHP version is <strong>5.3.15</strong></li>
  <li>MySql version used on the remote database server is <strong>5.5.13-55</strong></li>
  <li>Both Navicat and the PHP code are run from the same PC.</li>
  <li>The database admin created a <strong>ssl_user</strong> specially for testing. This user is denied normal access and must connect using ssl.</li>
  <li>No proxies are used.</li>
  <li>I tried <code>PDO</code> and it suffers from the same problem.</li>
  <li>I tried <code>mysql-&gt;connect()</code>, but it throws a bad handshake error and according to some comments in the <a href="http://php.net/manual/en/function.mysql-connect.php" rel="nofollow noreferrer">manual</a> it doesn't work.</li>
  <li>Open ssl is enabled from <code>phpinfo()</code>
  <img src="https://i.stack.imgur.com/edw7R.png" alt="enter image description here"></li>
  </ol>
  
  <p>So the question is why PHP isn't complaining about the wrong paths to the certificates? It seems PHP is ignoring the line where I set the certificate paths!!</p>
  
  <hr>
  
  <p><strong>UPDATE:</strong>
  I tried changing the line where I make the connection to explicitly set the port and use <code>MYSQLI_CLIENT_SSL</code>:</p>
  
  <pre><code>$mysqli-&gt;real_connect('xx.xx.xx.xx', 'my_user', 'my_password', 'my_db','3306',NULL,MYSQLI_CLIENT_SSL)
  </code></pre>
  
  <p>However, I got this error:</p>
  
  <pre><code>Warning: mysqli::real_connect(): (08S01/1043): Bad handshake in ...
  </code></pre>
  
  <p><strong>UPDATE 2:</strong></p>
  
  <p>This is the result of tcpdump-ing from the database server:</p>
  
  <pre><code>0x0040:  3142 6164 2068 616e 6473 6861 6b65       1Bad.handshake
  13:16:18.133282 IP (tos 0x8, ttl  64, id 40823, offset 0, flags [DF], proto: TCP (6), length: 52) xx.xx.xx.202.mysql &gt; xx.xx.xx.130.42766: F, cksum 0xf15f (correct), 112:112(0) ack 79 win 46 &lt;nop,nop,timestamp 19516376 3465907&gt;
          0x0000:  4508 0034 9f77 4000 4006 c8a7 c0a8 28ca  E..4.w@.@.....(.
          0x0010:  c0a8 2882 0cea a70e b36c 7e8b 7b4d a169  ..(......l~.{M.i
          0x0020:  8011 002e f15f 0000 0101 080a 0129 cbd8  ....._.......)..
          0x0030:  0034 e2b3                                .4..
  13:16:18.133433 IP (tos 0x8, ttl  64, id 17337, offset 0, flags [DF], proto: TCP (6), length: 52) xx.xx.xx.130.42766 &gt; xx.xx.xx.202.mysql: F, cksum 0xb695 (correct), 79:79(0) ack 113 win 92 &lt;nop,nop,timestamp 3480910 19516376&gt;
          0x0000:  4508 0034 43b9 4000 4006 2466 c0a8 2882  E..4C.@.@.$f..(.
          0x0010:  c0a8 28ca a70e 0cea 7b4d a169 b36c 7e8c  ..(.....{M.i.l~.
          0x0020:  8011 005c b695 0000 0101 080a 0035 1d4e  ...\.........5.N
          0x0030:  0129 cbd8                                .)..
  13:16:18.133452 IP (tos 0x8, ttl  64, id 40824, offset 0, flags [DF], proto: TCP (6), length: 52) xx.xx.xx.202.mysql &gt; xx.xx.xx.130.42766: ., cksum 0xb6c3 (correct), 113:113(0) ack 80 win 46 &lt;nop,nop,timestamp 19516376 3480910&gt;
          0x0000:  4508 0034 9f78 4000 4006 c8a6 c0a8 28ca  E..4.x@.@.....(.
          0x0010:  c0a8 2882 0cea a70e b36c 7e8c 7b4d a16a  ..(......l~.{M.j
          0x0020:  8010 002e b6c3 0000 0101 080a 0129 cbd8  .............)..
          0x0030:  0035 1d4e                                .5.N
  </code></pre>
  
  <p>xx.xx.xx.202 is the database server ip.<br>
  xx.xx.xx.130 is my PC ip.</p>
  
  <p><strong>UPDATE 3:</strong></p>
  
  <p>I checked for the password length using the following code:</p>
  
  <pre><code>mysql&gt; select length(Password) from mysql.user where User='youruser'
  </code></pre>
  
  <p>And the password length was <strong>41</strong>.</p>
  
  <p><strong>UPDATE 4:</strong></p>
  
  <p>There might be a hint in the error message returned when I connect using the command line via <strong>ssh</strong> on the remote server (I uploaded the whole project to the remote server):</p>
  
  <pre><code>mysql -u test_ssl -password --ssl-key=/usr/local/apache2/htdocs/certs/client-key.pem --ssl-cert=/usr/local/apache2/htdocs/certs/WRONG-CERTIFICATE.pem
  </code></pre>
  
  <p>I get the following error:</p>
  
  <pre><code>SSL error: Unable to get certificate from '/usr/local/apache2/htdocs/certs/WRONG-CERTIFICATE.pem'
  ERROR 2026 (HY000): SSL connection error ---&gt; notice the error here
  </code></pre>
  
  <p>If I don't supply any certificates at all I get the following message:</p>
  
  <pre><code>-bash-3.2$ mysql -u test_ssl -password
  ERROR 1045 (28000): Access denied for user 'test_ssl'@'localhost' (using password: YES)
  </code></pre>
  
  <p><strong>Which is the same error I get when I connect using PHP using correct or invalid paths to the certificates!!</strong></p>
  
  <p>Maybe this means something?</p>