Doc #80436 [Com]: MYSQL_ATTR_SSL_CAPATH Prevails on MYSQL_ATTR_SSL_VERIFY_SERVER_CERT

Edit report at https://bugs.php.net/bug.php?id=80436&edit=1

 ID:                 80436
 Comment by:         bayedewfrruff at gmail dot com
 Reported by:        Patrick dot Messier at canada dot ca
 Summary:            MYSQL_ATTR_SSL_CAPATH Prevails on
                     MYSQL_ATTR_SSL_VERIFY_SERVER_CERT
 Status:             Open
 Type:               Documentation Problem
 Package:            PDO MySQL
 Operating System:   debian buster
 PHP Version:        7.4.13
 Block user comment: N
 Private report:     N

 New Comment:

Thanks for that. (https://www.subarunet.me/)github.com


Previous Comments:
------------------------------------------------------------------------
[2020-11-28 11:09:40] Patrick dot Messier at canada dot ca

Description:
------------
It seams that whenever PDO::MYSQL_ATTR_SSL_CERT is set to something, PHP will try to validate the database certificate, regardless of the PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT value.

Test script:
---------------
I've successfully used the following value combination when connecting to MySQL servers that uses a certificate signed by a trusted Certificate Authority (CA).

PDO::MYSQL_ATTR_SSL_CAPATH=/etc/ssl/certs
PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT=true

Based on PHP documentation (https://www.php.net/manual/en/ref.pdo-mysql.php), I thought I could simply toggle MYSQL_ATTR_SSL_VERIFY_SERVER_CERT to false to allow connections to database servers that use self-signed certificate (i.e. for which the CA certificate is absent from /etc/ssl/certs). 

PDO::MYSQL_ATTR_SSL_CAPATH=/etc/ssl/certs
PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT=false



Expected result:
----------------
PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT set to false would prevent PHP from validating the database certificate regardless of the MYSQL_ATTR_SSL_CAPATH value.


Actual result:
--------------
Doing so constantly leads to the following error: 

PDO::__construct(): SSL operation failed with code 1. OpenSSL Error messages: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed

Surpringly, the following combinations works:

PDO::MYSQL_ATTR_SSL_CAPATH=null
PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT=[false|true]

In which case I believe the database server switches to unencrypted protocol, if it allows it, which is not what we want.


------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=80436&edit=1