last day (15 days later) » 

9:16 AM
0
Q: 'Access Denied' when trying to connect to Amazon-RDS instance using SSL from shared hosting (but it works when testing locally)

coder2kI'm trying to deploy a web app to a shared hosting provider (Strato), but I have problems establishing a SSL-connection to the Amazon-RDS instance that I'm using. While testing the web app locally (using XAMPP) it works fine, but on the shared hosting I get a HTTP-500 error response after a 2 min...

 
the password is incorrect your RDS is reacable using password: YES, double check the password.
 
@Adiii I'm using the exact same file locally and on the shared hosting. No differences at all (including the password). I also just double checked it now.
 
is the version same on local and shared hosting?
 
@Adiii You mean PHP version? Local version is 7.3.7, shared hosting version is 7.2.22. Is it possible that this causes the issue? EDIT: Just changed the shared hosting PHP version to 7.3.9 (I cannot choose 7.3.7). The issue is still there.
 
may be, but some thing wrong with your ssl config too i think
You can force all connections to your DB instance to use SSL. If you force connections to use SSL, it happens transparently to the client, and the client doesn't have to do any work to use SSL. If you want to force SSL, use the rds.force_ssl parameter. By default, the rds.force_ssl parameter is set to false. Set the rds.force_ssl parameter to true to force connections to use SSL. The rds.force_ssl parameter is static, so after you change the value, you must reboot your DB instance for the change to take effect.
 
9:16 AM
@Adiii The article you linked is only valid for "Microsoft SQL Server" instances. My instance is running "Aurora" and there is no rds.force_ssl parameter in the parameter group for my instance.
 
yeah got it, let try to debug without SSL config just to verify is it accessible or not
 
Without using SSL it works fine. It even works when I'm using the SSL config but try to connect using credentials of a user that does not require SSL.
 
so one thing is clear that it works without SSL?
how you create MySQL user? how you set the password?
 
Yes, absolutely sure. I just checked the phpinfo() on the shared hosting. It says MySQL Client API Version: 5.5.52. I seems like Amazon RDS supports TLS starting with MySQL 5.7, but I'm not really sure if this means server or client version.
 
which version of mysql RDS you are using?
 
9:16 AM
I added the user like so: CREATE USER 'username'@'%' IDENTIFIED BY 'password'; And then I did: GRANT DELETE, DROP, EXECUTE, INSERT, SELECT, UPDATE, ALTER ROUTINE, CREATE ROUTINE, ALTER ON db_name.* TO 'username'@'%' REQUIRE SSL;
 
` with RDS MySQL 5.6, older versions of MariaDB 10.0 and 10.1, and Aurora MySQL 5.6 only supporting TLS 1.0. `
 
I'm using Amazon Aurora MySQL, Engine version 5.6.10a.
 
so check the TLS version on which against you are trying to connect
 
I don't really know how to do this.
 
when you place the ssl config, read its properties or you can read in the documentation of shared hosting provider
 
9:16 AM
First another thing: In my script above there was a typo. I wrote value instead of Value. Now when running locally I get the expected output: Does the ca file exist? true Connected to database. DHE-RSA-AES128-SHA
Now the other thing: I hope I'm doing what you mean here. I did a query SHOW STATUS LIKE 'Ssl_Version' and when running locally I get TLSv1 as value, but when running on shared hosting I get an empty string (when connecting with the user that does not require SSL).
 
so if that does not require ssl so it mean you are not enforcing ssl?
 
That's basically the problem: When I'm trying to connect to the user that requires SSL I get the Access denied error. But this happens only when using the shared hosting. Enforcing SSL works when I'm running the script locally.
I just ran another test using an Amazon EC2 instance. I uploaded the exact same file and I could connect from there. So it works from my home and from the EC2 instance, but not from the Strato shared hosting server. Any idea what configuration on their end could cause this? I think I'll also contact them.
 
YEs please do connect with support team
 

last day (15 days later) »