title: SSL protected PDO connection not working - SQLSTATE SSL Error - Access denied for user (using password: YES)
body: <p>I created a user via MySQL Workbench.</p>
  
  <pre><code>    CREATE USER 'fba_user'@'%' IDENTIFIED BY 'my_Pa$$word';
      CREATE USER 'fba_user'@'localhost' IDENTIFIED BY 'my_Pa$$word';
      FLUSH PRIVILEGES;
      GRANT ALL PRIVILEGES ON fallbackauthdb.* TO 'fba_user'@'%' IDENTIFIED BY 'my_Pa$$word' REQUIRE SSL;
      GRANT ALL PRIVILEGES ON fallbackauthdb.* TO 'fba_user'@'localhost' IDENTIFIED BY 'my_Pa$$word' REQUIRE SSL;
      FLUSH PRIVILEGES;
  </code></pre>
  
  <p>I configured the <strong>MySQL Server (5.5.34-0ubuntu0.13.04.1)</strong> to use SSL by generating the needed certificates and keys and configured them via /etc/mysql/my.cnf</p>
  
  <p>If I try to connect <strong>via CLI on a client machine everything just works great</strong>.</p>
  
  <pre><code>    user@ClientPC:~$ mysql -h mysql.example.com --port=3306  -v --ssl-ca=/home/user/demo/ca-cert.pem --ssl-cert=/home/user/demo/client-cert.pem --ssl-key=/home/user/demo/client-key.pem -u fba_user -p
      Enter password: my_Pa$$word
  
      Welcome to the MySQL monitor.  Commands end with ; or \g.
      Your MySQL connection id is 99
      Server version: 5.5.34-0ubuntu0.13.04.1 (Ubuntu)
  
      Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
  
      Oracle is a registered trademark of Oracle Corporation and/or its
      affiliates. Other names may be trademarks of their respective
      owners.
  
      Reading history-file /home/user/.mysql_history
      Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
  
      mysql&gt; SHOW STATUS LIKE "%SSL%";
      --------------
      SHOW STATUS LIKE "%SSL%"
      --------------
  
      +--------------------------------+------------------------+
      | Variable_name                  | Value                  |
      +--------------------------------+------------------------+
      | Com_show_processlist           | 0                      |
      | Ssl_accept_renegotiates        | 0                      |
      | Ssl_accepts                    | 0                      |
      | Ssl_callback_cache_hits        | 0                      |
      | Ssl_cipher                     | DHE-RSA-AES256-SHA     |
      | ...                            | ...                    |
      +--------------------------------+------------------------+
  </code></pre>
  
  <p>But <strong>if I use PHP (PHP/5.4.9-4ubuntu2.3) with PDO to connect to the database, the connection is not working</strong>. I tried php5-mysql driver and I tried the php5-mysqlnd (Native Driver). Both do not change a thing.</p>
  
  <pre><code>    &lt;?php
      error_reporting(E_ALL);
      ini_set("display_errors", "1");
  
        if (!defined('PDO::ATTR_DRIVER_NAME')) {
          echo 'PDO unavailable';
        }
        elseif (defined('PDO::ATTR_DRIVER_NAME')) {
          echo 'PDO available';
        }
  
        $pdo = new PDO('mysql:host=mysql.example.com;dbname=fallbackauthdb;charset=utf8', 'fba_user', 'my_Pa$$word', array(
          PDO::MYSQL_ATTR_SSL_KEY  =&gt; '/etc/mysql/client-key.pem',
          PDO::MYSQL_ATTR_SSL_CERT =&gt; '/etc/mysql/client-cert.pem',
          PDO::MYSQL_ATTR_SSL_CA   =&gt; '/etc/mysql/ca-cert.pem'
        ));
  
        foreach ($pdo-&gt;query('SHOW STATUS LIKE "%Ssl%"') as $row) {
          print_r($row[0] ."=". $row[1] . PHP_EOL);
        }
      ?&gt;
  </code></pre>
  
  <p>Thats the error message I got:</p>
  
  <pre><code>    PDO available
      Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[HY000] [1045] Access denied for user 'fba_user'@'mysql.example.com' (using password: YES)' in /var/www/gfa/sql.php:17 Stack trace: #0 /var/www/gfa/sql.php(17): PDO-&gt;__construct('mysql:host=mysq...', 'fba_user', 'my_Pa$$...', Array) #1 {main} thrown in /var/www/gfa/sql.php on line 17
  </code></pre>
  
  <p><strong>If I disable SSL</strong> by "not requireing" it on the fba_user, <strong>the connection with PDO just works fine</strong>. I think its a bug, but maybe someone else can help please?</p>
  
  <p><strong>EDIT 1</strong>: If I use the database-root user instead, the connection is working, but I'm not sure if ssl is used, because the query:</p>
  
  <pre><code>     SHOW STATUS LIKE "%SSL%";
  </code></pre>
  
  <p>does return</p>
  
  <pre><code>     DHE-RSA-AES256-SHA
  </code></pre>
  
  <p>but I think the system is lying and is not using SSL secured mysql-connection at all.</p>
  
  <p><strong>EDIT 2</strong>: I sniffed the packets and yes, for the root-User the connection is secured via SSL, but for the fba_user this isn't the case.</p>
  
  <p>Why I thought the system is lying?: I can change the path in the PHP script for the client certificates and I can even delete them from the system and reboot the server. The connection is still SSL encrypted, WTF?</p>