Symfony6+PHP8.1连接MariaDB10.9仅关闭SSL证书验证才可工作

核心问题 #

你用IP连接MariaDB，但服务器证书的CN是fake-server，SSL验证时IP和证书里的身份信息不匹配，导致必须关闭PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT才能建立连接。

SSL证书验证服务器身份时，会检查证书的**CN（通用名称）或SAN（主题备用名称）**是否包含你用来连接的主机标识（这里是IP）。你的服务器证书CN是fake-server，和连接用的127.0.0.1/生产IP完全不匹配，所以验证失败，只能临时关闭证书校验。另外原证书脚本里生成CA时用了错误变量OPENSSL_ROOT_CA，这也可能导致证书链异常。

修复步骤 #

1. 修改证书生成脚本，给服务器证书添加IP作为SAN #

修改后的脚本会生成包含IP地址SAN字段的服务器证书，确保IP能通过SSL身份验证：

OPENSSL_SUBJ="/C=US/ST=California/L=Santa Clara"
OPENSSL_CA="${OPENSSL_SUBJ}/CN=fake-ca"
OPENSSL_SERVER="${OPENSSL_SUBJ}/CN=fake-server"
OPENSSL_CLIENT="${OPENSSL_SUBJ}/CN=fake-client"

# 创建SAN配置文件，添加开发/生产环境的IP
cat > certs/server-san.cnf << EOF
[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name

[req_distinguished_name]

[v3_req]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[alt_names]
IP.1 = 127.0.0.1
# 生产环境IP请添加到这里，比如：
# IP.2 = 192.168.xxx.xxx
EOF

# 生成CA证书（修正原脚本的变量错误）
openssl genrsa 2048 > certs/ca-key.pem
openssl req -new -x509 -sha256 -nodes -days 3600 \
        -subj "${OPENSSL_CA}" \
        -key certs/ca-key.pem -out certs/ca-cert.pem

# 生成服务器证书请求时引用SAN配置
openssl req -newkey rsa:2048 -sha256 -days 3600 -nodes \
        -subj "${OPENSSL_SERVER}" \
        -keyout certs/server-key.pem -out certs/server-req.pem \
        -config certs/server-san.cnf

openssl rsa -in certs/server-key.pem -out certs/server-key.pem

# 签名服务器证书时带上SAN扩展
openssl x509 -req -in certs/server-req.pem -sha256 -days 3600 \
        -CA certs/ca-cert.pem -CAkey certs/ca-key.pem \
        -set_serial 01 -out certs/server-cert.pem \
        -extfile certs/server-san.cnf -extensions v3_req

openssl verify -CAfile certs/ca-cert.pem certs/server-cert.pem

# 客户端证书生成逻辑保持不变
openssl req -newkey rsa:2048 -sha256 -days 3600 -nodes \
        -subj "${OPENSSL_CLIENT}" \
        -keyout certs/client-key.pem -out certs/client-req.pem
openssl rsa -in certs/client-key.pem -out certs/client-key.pem
openssl x509 -req -in certs/client-req.pem -sha256 -days 3600 \
        -CA certs/ca-cert.pem -CAkey certs/ca-key.pem \
        -set_serial 01 -out certs/client-cert.pem
openssl verify -CAfile certs/ca-cert.pem certs/client-cert.pem

2. 调整Symfony数据库配置 #

移除禁用证书验证的选项，确保配置指向正确的证书路径：

# config/packages/doctrine.yaml
doctrine:
    dbal:
        url: '%env(resolve:DATABASE_URL)%'
        ssl: true
        ssl_ca: '%kernel.project_dir%/certs/ca-cert.pem'
        ssl_cert: '%kernel.project_dir%/certs/client-cert.pem'
        ssl_key: '%kernel.project_dir%/certs/client-key.pem'
        # 删除以下禁用验证的配置
        # options:
        #     !php/const PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT: false

若使用DATABASE_URL环境变量配置：

DATABASE_URL="mysql://用户名:密码@127.0.0.1:3306/数据库名?sslmode=verify_ca&sslrootcert=%kernel.project_dir%/certs/ca-cert.pem&sslcert=%kernel.project_dir%/certs/client-cert.pem&sslkey=%kernel.project_dir%/certs/client-key.pem"

验证 #

重新生成证书后，重启MariaDB和Symfony应用，即可正常建立SSL连接，无需关闭证书验证。

内容的提问来源于stack exchange，提问作者Sam