SSL Connections from Azure Database for MySQL using CA file

Question

Following along with the Azure Documentation for their New MySQL service, it appears that you can setup SSL pretty simply with their Trusted CA Cert.

After following their steps and setting up my PHP connection string according to their docs, I get the following error:

Peer certificate CN=`AZUREREGION.control.database.windows.net' did not match expected CN=`MYDATABASE.mysql.database.azure.com' in testazure.php

I was able to "work around" the issue by changing my connection string's hostname from MYDATABASE.mysql.database.azure.com to AZUREREGION.control.database.windows.net but I feel like that's probably not what I should be doing. Any guidance from people more knowledgeable about either Azure Database for MySQL or PHP's SSL connections would be helpful!

----- UPDATE -----

I had previously accepted Jason's response below. His answer is NOT adequate. If you do as I mistakenly did above you WILL eventually experience an outage when MSFT decides to change the underlying DNS resolution for your database.

I ended up suffering an outage today because of this answer. I think you may need to answer my question more thoroughly. As I mentioned in my question, I felt like something was off by changing the "host" path to the region. About 20 minutes ago, your internal DNS service changed the underlying region record for "MYDATABASE.mysql.database.azure.com" to "cr2.MYREGION.control.database.windows.net" instead of "MYREGION.control.database.windows.net" without any warning. As such, I'm removing the accepted answer.

Yes, I can connect over SSL to the MySQL instance via mysql-cli. I But, I think Jason's answer below resolves the issue. — Damien R
– Damien R, Commented May 15, 2017 at 18:30

Jason Anderson · Accepted Answer · 2017-05-15 15:45:58Z

3

Your work-around is actually correct. As we were launching the service, we changed the DNS of the service to more accurately reflect your server, however we need to update the documentation as appropriate.

Thanks for reporting - we'll get the docs updated!

Jason Azure DB for MySQL team

answered May 15, 2017 at 15:45

Jason Anderson

1864 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Damien R Over a year ago

I ended up suffering an outage today because of this answer. I think you may need to answer my question more thoroughly. As I mentioned in my question, I felt like something was off by changing the "host" path to the region. About 20 minutes ago, your internal DNS service changed the underlying region record for "MYDATABASE.mysql.database.azure.com" to "cr2.MYREGION.control.database.windows.net" instead of "MYREGION.control.database.windows.net" without any warning. As such, I'm removing the accepted answer.

Collectives™ on Stack Overflow

SSL Connections from Azure Database for MySQL using CA file

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related