Docker Compose配置PHPMyAdmin本地HTTPS访问问题求助

1. 生成本地自签SSL证书 #

在项目根目录执行以下命令，生成供MySQL和PHPMyAdmin使用的自签证书（本地测试用，无需CA机构认证）：

# 创建证书存储目录
mkdir -p ssl/mysql ssl/phpmyadmin

# 生成MySQL的CA证书、服务器证书及密钥
openssl req -x509 -newkey rsa:4096 -days 365 -nodes -keyout ssl/mysql/server-key.pem -out ssl/mysql/server-cert.pem -subj "/CN=mysql"
openssl req -x509 -newkey rsa:4096 -days 365 -nodes -keyout ssl/mysql/ca-key.pem -out ssl/mysql/ca-cert.pem -subj "/CN=mysql-ca"

# 生成PHPMyAdmin的SSL证书（也可复用MySQL证书，此处为独立示例）
openssl req -x509 -newkey rsa:4096 -days 365 -nodes -keyout ssl/phpmyadmin/key.pem -out ssl/phpmyadmin/cert.pem -subj "/CN=localhost"

2. 修正Docker Compose配置 #

更新docker-compose.yml，调整端口映射、添加SSL证书挂载，同时加入Prestashop服务：

version: "3.9"
networks:
  3maj:
volumes:
  dbdata:
  prestashop_data:
services:
  mysql:
    image: mysql
    container_name: 3maj-mysql
    restart: unless-stopped
    networks:
      - 3maj
    volumes:
      - dbdata:/var/lib/mysql
      - ./ssl/mysql/ca-cert.pem:/etc/mysql/ssl/ca-cert.pem
      - ./ssl/mysql/server-cert.pem:/etc/mysql/ssl/server-cert.pem
      - ./ssl/mysql/server-key.pem:/etc/mysql/ssl/server-key.pem
    environment:
      MYSQL_RANDOM_ROOT_PASSWORD: 1
      MYSQL_DATABASE: ${DB_NAME}
      MYSQL_USER: ${DB_USER}
      MYSQL_PASSWORD: ${DB_PASSWORD}
      MYSQL_ALLOW_EMPTY_PASSWORD: 'no'
    command: --ssl-ca=/etc/mysql/ssl/ca-cert.pem --ssl-cert=/etc/mysql/ssl/server-cert.pem --ssl-key=/etc/mysql/ssl/server-key.pem --require-secure-transport=ON

  phpmyadmin:
    image: phpmyadmin
    container_name: 3maj-phpmyadmin
    restart: unless-stopped
    networks:
      - 3maj
    depends_on:
      - mysql
    ports:
      - ${PMA_PORT}:80          # 可选保留HTTP访问端口
      - ${PMA_SSL_PORT}:443     # 本地8443端口映射容器HTTPS默认端口
    volumes:
      - ./config.user.inc.php:/etc/phpmyadmin/config.user.inc.php
      - ./ssl/phpmyadmin/cert.pem:/etc/apache2/ssl/cert.pem
      - ./ssl/phpmyadmin/key.pem:/etc/apache2/ssl/key.pem
      - ./ssl/mysql/ca-cert.pem:/etc/mysql/ssl/ca-cert.pem
    environment:
      PMA_HOST: ${DB_SERVER}
      PMA_USER: ${DB_USER}
      PMA_PASSWORD: ${DB_PASSWORD}
      PMA_SSL: true

  prestashop:
    image: prestashop/prestashop
    container_name: 3maj-prestashop
    restart: unless-stopped
    networks:
      - 3maj
    depends_on:
      - mysql
    ports:
      - 8000:80
    volumes:
      - prestashop_data:/var/www/html
    environment:
      DB_SERVER: ${DB_SERVER}
      DB_NAME: ${DB_NAME}
      DB_USER: ${DB_USER}
      DB_PASSWORD: ${DB_PASSWORD}
      PS_INSTALL_AUTO: 1
      PS_DOMAIN: localhost:8000

3. 更新PHPMyAdmin配置文件 #

修改config.user.inc.php，适配自签证书验证规则并指定证书路径：

<?php

$i = 1;
$cfg['ForceSSL'] = true; // 强制所有访问走HTTPS
$cfg['Servers'][$i]['ssl'] = true;
$cfg['Servers'][$i]['ssl_verify'] = false; // 自签证书关闭验证，避免浏览器报错
$cfg['Servers'][$i]['ssl_ca'] = '/etc/mysql/ssl/ca-cert.pem';
$cfg['SslCert'] = '/etc/apache2/ssl/cert.pem';
$cfg['SslKey'] = '/etc/apache2/ssl/key.pem';

4. 启动服务并验证 #

执行命令启动所有容器：

docker-compose up -d

• 访问https://localhost:8443即可通过HTTPS进入PHPMyAdmin
• 访问http://localhost:8000进入Prestashop后台
• MySQL已强制启用SSL连接，PHPMyAdmin与Prestashop均会通过SSL与数据库通信

关键注意事项 #

• 自签证书在浏览器中会提示"不安全"，本地测试可直接忽略或手动添加证书信任
• 原配置中PHPMyAdmin端口映射逻辑错误，需将本地HTTPS端口映射到容器的443端口
• MySQL的--require-secure-transport=ON参数强制所有连接使用SSL，匹配生产环境安全要求

内容的提问来源于stack exchange，提问作者3maj