mysql - 是否可以通过 ssl 将 typeorm 连接到 sql gcloud 的实例？

Question

我正在尝试创建到谷歌云中的 SQL 实例 的 SSL 连接。我正在使用 node.js、typescript 和 typeorm 作为 orm。

我想使用 ormconfig.json 来完成。 <强> official documentation 说这是可能的，但它只使用一个参数(CA 文件)。我需要使用 3 个 SSL 文件:server-ca.pem、client-cert.pem 和 client-key.pem。

我可以使用以下 mysql 命令连接:

"mysql -uroot -p -h 35.225.71.53 --ssl-ca=server-ca.pem --ssl-cert=client-cert.pem  --ssl-key=client-key.pem"

我尝试使用这个 ormconfig.json，但没有成功:

{
   "type": "mysql",
   "host": "IP",
   "port": 3306,
   "username": "user",
   "password": "password",
   "database": "database",
   "ssl": {
      "ca": "path/to/server-ca.pem",
      "cert": "path/to/server-cert.pem",
      "key": "path/to/erver-key.pem"
   }
...
}

和其他组合。

我在执行命令(例如:typeorm migration:run)时收到的错误是:

typeorm migrations:run
Error during migration run:
{ Error: error:0906D06C:PEM routines:PEM_read_bio:no start line
    at Object.createSecureContext (_tls_common.js:104:17)
    at createSecureContext (C:\Users\Lucas\Desktop\koa\cloudfunctions\functions\node_modules\mysql\lib\Connection.js:466:19)
    at PoolConnection._startTLS (C:\Users\Lucas\Desktop\koa\cloudfunctions\functions\node_modules\mysql\lib\Connection.js:282:5)
    at Handshake.<anonymous> (C:\Users\Lucas\Desktop\koa\cloudfunctions\functions\node_modules\mysql\lib\protocol\Protocol.js:172:24)
    at emitNone (events.js:106:13)
    at Handshake.emit (events.js:208:7)
    at Handshake.HandshakeInitializationPacket (C:\Users\Lucas\Desktop\koa\cloudfunctions\functions\node_modules\mysql\lib\protocol\sequences\Handshake.js:78:10)
    at Protocol._parsePacket (C:\Users\Lucas\Desktop\koa\cloudfunctions\functions\node_modules\mysql\lib\protocol\Protocol.js:291:23)
    at Parser._parsePacket (C:\Users\Lucas\Desktop\koa\cloudfunctions\functions\node_modules\mysql\lib\protocol\Parser.js:433:10)
    at Parser.write (C:\Users\Lucas\Desktop\koa\cloudfunctions\functions\node_modules\mysql\lib\protocol\Parser.js:43:10)
    --------------------
    at Protocol._enqueue (C:\Users\Lucas\Desktop\koa\cloudfunctions\functions\node_modules\mysql\lib\protocol\Protocol.js:144:48)
    at Protocol.handshake (C:\Users\Lucas\Desktop\koa\cloudfunctions\functions\node_modules\mysql\lib\protocol\Protocol.js:51:23)
    at PoolConnection.connect (C:\Users\Lucas\Desktop\koa\cloudfunctions\functions\node_modules\mysql\lib\Connection.js:119:18)
    at Pool.getConnection (C:\Users\Lucas\Desktop\koa\cloudfunctions\functions\node_modules\mysql\lib\Pool.js:48:16)
    at C:\Users\Lucas\AppData\Roaming\npm\node_modules\typeorm\driver\mysql\MysqlDriver.js:764:18
    at new Promise (<anonymous>)
    at MysqlDriver.createPool (C:\Users\Lucas\AppData\Roaming\npm\node_modules\typeorm\driver\mysql\MysqlDriver.js:761:16)
    at MysqlDriver.<anonymous> (C:\Users\Lucas\AppData\Roaming\npm\node_modules\typeorm\driver\mysql\MysqlDriver.js:274:51)
    at step (C:\Users\Lucas\AppData\Roaming\npm\node_modules\typeorm\node_modules\tslib\tslib.js:133:27)
    at Object.next (C:\Users\Lucas\AppData\Roaming\npm\node_modules\typeorm\node_modules\tslib\tslib.js:114:57) code: 'HANDSHAKE_SSL_ERROR', fatal: true }

C:\Users\Lucas\Desktop\koa\cloudfunctions\functions>

Answer 1

在 SSL options 的 TypeORM 文档中，他们提到:

Please note the arguments expect a string of the certificate, not a file name to the certificate.

因此您需要加载文件以连接到 Google Cloud SQL 实例，而不仅仅是提供路径:

const fs = require("fs");

{
   "type": "mysql",
   "host": "IP",
   "port": 3306,
   "username": "user",
   "password": "password",
   "database": "database",
   "ssl": {
     "ca": fs.readFileSync(__dirname + '/server-ca.pem'),
     "cert": fs.readFileSync(__dirname + '/client-cert.pem'),
     "key": fs.readFileSync(__dirname + '/client-key.pem'),
   }
...
}