I have a working SSL setup between symfony 6 on PHP 8.1 application and mariadb 10.9 but it only works if I add the option !php/const PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT: false
This is for me only a temporary fix but could not find the root of the issue.
I have experimented a lot with different CN because I read it could be this but can't make it work.
my dev is ip 127.0.0.1 (docker container is database) and my prod server has an ip only too. I do not have any domain name
here is gencerts.sh
OPENSSL_SUBJ="/C=US/ST=California/L=Santa Clara"
OPENSSL_CA="${OPENSSL_SUBJ}/CN=fake-ca"
OPENSSL_SERVER="${OPENSSL_SUBJ}/CN=fake-server"
OPENSSL_CLIENT="${OPENSSL_SUBJ}/CN=fake-client"
openssl genrsa 2048 > certs/ca-key.pem
openssl req -new -x509 -sha256 -nodes -days 3600 \
-subj "${OPENSSL_ROOT_CA}" \
-key /certs/ca-key.pem -out /certs/ca-cert.pem
openssl req -newkey rsa:2048 -sha256 -days 3600 -nodes \
-subj "${OPENSSL_SERVER}" \
-keyout /certs/server-key.pem -out /certs/server-req.pem
openssl rsa -in /certs/server-key.pem -out /certs/server-key.pem
openssl x509 -req -in /certs/server-req.pem -sha256 -days 3600 \
-CA /certs/ca-cert.pem -CAkey /certs/ca-key.pem \
-set_serial 01 -out /certs/server-cert.pem
openssl verify -CAfile /certs/ca-cert.pem /certs/server-cert.pem
openssl req -newkey rsa:2048 -sha256 -days 3600 -nodes \
-subj "${OPENSSL_CLIENT}" \
-keyout /certs/client-key.pem -out /certs/client-req.pem
openssl rsa -in /certs/client-key.pem -out /certs/client-key.pem
openssl x509 -req -in /certs/client-req.pem -sha256 -days 3600 \
-CA /certs/ca-cert.pem -CAkey /certs/ca-key.pem \
-set_serial 01 -out /certs/client-cert.pem
openssl verify -CAfile /certs/ca-cert.pem /certs/client-cert.pem
error
SQLSTATE[HY000] [2002] (trying to connect via (null))
docker log is
2022-09-13 14:26:34 3 [Warning] Aborted connection 3 to db: 'unconnected' user: 'unauthenticated' host: '192.168.16.3' (This connection closed normally without authentication)