php - PHP PDO (MySQL) 中的 SSL 支持如何工作？

Question

我熟悉 HTTPS 中实现的公钥/私钥协商，这就是为什么我对以下驱动程序选项感到困惑 apparently available (虽然没有正式记录)对于 PDO 的 MySQL 驱动程序:

PDO::MYSQL_ATTR_SSL_KEY
PDO::MYSQL_ATTR_SSL_CERT
PDO::MYSQL_ATTR_SSL_CA

该链接表明它们指向本地存储的文件 - 但为什么除了 CA 证书之外的任何内容的副本都存储在客户端上？有没有人使用此方法成功建立加密连接？

Answer 1

这与客户端必须拥有才能连接到服务器的客户端证书有关，即客户端必须验证其身份(是的，SSL 也可以反过来工作)。从阅读一般部分开始 Using SSL for Secure Connections ，然后查看 GRANT syntax 中的 REQUIRE 子句:

• REQUIRE X509 means that the client must have a valid certificate but that the exact certificate, issuer, and subject do not matter. The only requirement is that it should be possible to verify its signature with one of the CA certificates.

• REQUIRE ISSUER 'issuer' places the restriction on connection attempts that the client must present a valid X509 certificate issued by CA 'issuer'. If the client presents a certificate that is valid but has a different issuer, the server rejects the connection. Use of X509 certificates always implies encryption, so the SSL option is unnecessary in this case.

• ...