I'm setting up phpMyAdmin over SSL (HTTPS) and also SSL connections to database servers.
I've configured Nginx with SSL certificates. I've commented out the version check on phpMyAdmin as it was connecting via HTTP and breaking secure connection.
All database servers are SSL enabled:
Variable_name Value have_openssl YES have_ssl YES ssl_ca /etc/mysql/ca-cert.pem ssl_capath ssl_cert /etc/mysql/server-cert.pem ssl_cipher ssl_key /etc/mysql/server-key.pem
I've added the directive
$cfg['Servers'][$i]['ssl'] = TRUE; to phpMyAdmin config file but I haven't specified paths to certs/keys, values:
$cfg['Servers'][$i]['ca'] = '/etc/ssl/certs/ca-cert.pem'; $cfg['Servers'][$i]['cert'] = '/etc/mysql/client-cert.pem'; $cfg['Servers'][$i]['key'] = '/etc/mysql/client-key.pem';
- however it looks like I'm using SSL connections between web server and database servers:
Could you please help me to understand how this works without certificates on the webserver and if I'm actually using encrypted connection to db servers? Is it possible that it's cached somewhere as I've enabled these directives for a moment?
I've also noticed strange behaviour:
When I logged in to PMA I see the following URL:
- when I remove the long string and access the FQDN only (example.com) by pressing enter, the server logged me off however when I add some random string (example.com/sdfsfefse) - enter, I'm logged in without specifying password. Is it something to do with cookies?