Answers.Body: <p>The code to use ssl was never finished and doesn't work for scripts. You could try reviving some variation of <a href="https://github.com/civicrm/civicrm-core/pull/18125" rel="nofollow noreferrer">https://github.com/civicrm/civicrm-core/pull/18125</a>.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-09-04T14:43:37.867Z
Answers.Text: can I ask if I can request for a Gitlab issue to be opened for this?
Answers.UserDisplayName: Lance Abais
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-09-04T15:19:55.057Z
Answers.Text: There is a gitlab https://lab.civicrm.org/dev/core/-/issues/1926, but without someone either funding a consultant to finish it or doing it themselves it will probably just stay half finished.
Answers.UserDisplayName: Demerit
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-08-14T13:41:54.273Z
Answers.LastActivityDate: 2024-08-14T13:41:54.273Z
Answers.UserDisplayName: Demerit
Body: <p>I am trying to configure TLS connectivity with MySQL on a CiviCRM instance.</p>
  <p>However, I am encountering the following errors when trying to run any <code>cv</code> commands.</p>
  <pre><code>cv setting:get
  
  &lt;p&gt;Initialization Error&lt;/p&gt;&lt;p&gt;&lt;pre&gt;Array
  (
      [callback] =&amp;gt; Array
          (
              [0] =&amp;gt; CRM_Core_Error
              [1] =&amp;gt; simpleHandler
          )
  
      [code] =&amp;gt; -24
      [message] =&amp;gt; DB Error: connect failed
      [mode] =&amp;gt; 16
      [debug_info] =&amp;gt;  [DB Error: connect failed]
      [type] =&amp;gt; DB_Error
      [user_info] =&amp;gt;  [DB Error: connect failed]
      [to_string] =&amp;gt; [db_error: message=&amp;quot;DB Error: connect failed&amp;quot; code=-24 mode=callback callback=CRM_Core_Error::simpleHandler prefix=&amp;quot;&amp;quot; info=&amp;quot; [DB Error: connect failed]&amp;quot;]
  )
  &lt;/pre&gt;&lt;/p&gt;
  </code></pre>
  <p>Here is what I used for <code>CIVICRM_DSN</code>:</p>
  <pre><code>    define('CIVICRM_DSN', 'mysql://' . $civicrm_db_user . ':' . urlencode($civicrm_db_pass) . '@' . $civicrm_db_host . ':' . $civicrm_db_port . '/' . $civicrm_db_name . '?new_link=true&amp;ca=%2Fetc%2Fssl%2Fmysql%2Fdatabase-certificate.pem&amp;ssl=true');
  </code></pre>
  <p>Here is what I have tried using for Drupal in <code>settings.php</code>:</p>
  <pre><code>$databases = [
      'default' =&gt; [
          'default' =&gt; [
              'database' =&gt; $drupal_db_name,
              'username' =&gt; $drupal_db_user,
              'password' =&gt; $drupal_db_pass,
              'host' =&gt; $drupal_db_host,
              'port' =&gt; $drupal_db_port,
              'driver' =&gt; 'mysql',
              'prefix' =&gt; '',
              'driver options' =&gt; array(
                PDO::MYSQL_ATTR_SSL_CA =&gt; '/etc/ssl/mysql/database-certificate.pem',
            ),
          ],
      ],
  ];
  </code></pre>
  <p>I have confirmed that the certificate is accessible and has the right permissions. I am also able to connect to the database with TLS using <code>mysql-client</code>.</p>
  <p>I have also tried configuring the <code>DSN</code> without the <code>ca</code> option and leaving in <code>ssl=true</code>, but this makes it that CiviCRM is accessing the site without TLS.</p>
  <p>Are there other places in the configuration that I can use or attempt or are there misconfigurations in my setup?</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2024-10-09T11:28:00.060Z
Comments.Text: Adding in environment versions for reference.
  Environment Versions:
  
  MySQL: 5.7.44
  PHP: 8.0.27
  Drupal: 7.98
  CiviCRM: 5.51.3
  cv: 0.3.58
Comments.UserDisplayName: Lance Abais
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2024-10-09T19:40:34.937Z
Comments.Text: One challenge here is that we don't see internal warnings about MySQL-SSL processing. It may take some looking to find the best way to fix that, but for now -- here's a crude patch to get more debug info: https://gist.github.com/totten/a85d6ad62c1b82f660878a46fd18c6c8
Comments.UserDisplayName: Tim Otten
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2024-10-10T17:49:54.803Z
Comments.Text: Clarifications: 
  (1) Does Civi's web UI work for you with MySQL-SSL? Is the problem limited to cv-CLI?
  (2) Does Drupal CLI (drush) work? Which version?
  (3) Are web UI and CLI running the same binaries/builds of PHP? (*e.g. same version, same distro/container*) 
  (4) When calling cv, does it make a difference to switch [bootstrap vars](https://github.com/civicrm/cv?tab=readme-ov-file#bootstrap)?
Comments.UserDisplayName: Tim Otten
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2024-10-11T20:04:53.617Z
Comments.Text: Another tip: For the `cv` command that fails, enable verbose output (`cv setting:get -vvv`)
Comments.UserDisplayName: Tim Otten
Tags: <mysql-5.7>
Title: TLS MySQL Connectivity not picked up
ThreadText: # TLS MySQL Connectivity not picked up
  
  (Asked by: username_0 on 2024-08-14)
  
  I am trying to configure TLS connectivity with MySQL on a CiviCRM instance.
  
  However, I am encountering the following errors when trying to run any `cv` commands.
  
  ```
  cv setting:get
  
  <p>Initialization Error</p><p><pre>Array
  (
      [callback] =&gt; Array
          (
              [0] =&gt; CRM_Core_Error
              [1] =&gt; simpleHandler
          )
  
      [code] =&gt; -24
      [message] =&gt; DB Error: connect failed
      [mode] =&gt; 16
      [debug_info] =&gt;  [DB Error: connect failed]
      [type] =&gt; DB_Error
      [user_info] =&gt;  [DB Error: connect failed]
      [to_string] =&gt; [db_error: message=&quot;DB Error: connect failed&quot; code=-24 mode=callback callback=CRM_Core_Error::simpleHandler prefix=&quot;&quot; info=&quot; [DB Error: connect failed]&quot;]
  )
  </pre></p>
  
  ```
  
  Here is what I used for `CIVICRM_DSN`:
  
  ```
      define('CIVICRM_DSN', 'mysql://' . $civicrm_db_user . ':' . urlencode($civicrm_db_pass) . '@' . $civicrm_db_host . ':' . $civicrm_db_port . '/' . $civicrm_db_name . '?new_link=true&ca=%2Fetc%2Fssl%2Fmysql%2Fdatabase-certificate.pem&ssl=true');
  
  ```
  
  Here is what I have tried using for Drupal in `settings.php`:
  
  ```
  $databases = [
      'default' => [
          'default' => [
              'database' => $drupal_db_name,
              'username' => $drupal_db_user,
              'password' => $drupal_db_pass,
              'host' => $drupal_db_host,
              'port' => $drupal_db_port,
              'driver' => 'mysql',
              'prefix' => '',
              'driver options' => array(
                PDO::MYSQL_ATTR_SSL_CA => '/etc/ssl/mysql/database-certificate.pem',
            ),
          ],
      ],
  ];
  
  ```
  
  I have confirmed that the certificate is accessible and has the right permissions. I am also able to connect to the database with TLS using `mysql-client`.
  
  I have also tried configuring the `DSN` without the `ca` option and leaving in `ssl=true`, but this makes it that CiviCRM is accessing the site without TLS.
  
  Are there other places in the configuration that I can use or attempt or are there misconfigurations in my setup?
  
  **Tags:** mysql-5.7
  
  > **Comments:**
  > **username_0**: Adding in environment versions for reference. Environment Versions:  MySQL: 5.7.44 PHP: 8.0.27 Drupal: 7.98 CiviCRM: 5.51.3 cv: 0.3.58  
  > **username_1**: One challenge here is that we don't see internal warnings about MySQL-SSL processing. It may take some looking to find the best way to fix that, but for now -- here's a crude patch to get more debug info: https://gist.github.com/totten/a85d6ad62c1b82f660878a46fd18c6c8  
  > **username_1**: Clarifications:  (1) Does Civi's web UI work for you with MySQL-SSL? Is the problem limited to cv-CLI? (2) Does Drupal CLI (drush) work? Which version? (3) Are web UI and CLI running the same binaries/builds of PHP? (*e.g. same version, same distro/container*)  (4) When calling cv, does it make a difference to switch [bootstrap vars](https://github.com/civicrm/cv?tab=readme-ov-file#bootstrap)?  
  > **username_1**: Another tip: For the `cv` command that fails, enable verbose output (`cv setting:get -vvv`)  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2024-08-14. Score: 0 | Accepted answer
  
  The code to use ssl was never finished and doesn't work for scripts. You could try reviving some variation of <https://github.com/civicrm/civicrm-core/pull/18125>.
  
  > **Comments:**
  > **username_0**: can I ask if I can request for a Gitlab issue to be opened for this?  
  > **username_2**: There is a gitlab https://lab.civicrm.org/dev/core/-/issues/1926, but without someone either funding a consultant to finish it or doing it themselves it will probably just stay half finished.  
  
  ---
  
  