mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-05-04 18:08:46 +03:00
Support SSL-secured MySQL database connectivity #1138
Open
opened 2026-02-04 23:57:28 +03:00 by OVERLORD
·
13 comments
No Branch/Tag Specified
development
l10n_development
release
v26-03
ci_fixing
codeberg-actions
lexical_may_2026
MilnerMart/development
sort_rule_text
GamerClassN7/impersonations-for-admin
Zhey-on/feature/csp-image-css-controls-6033
tortillas5/development
clauvaldez/mfaReset
llm_only
vectors
McTom234/oidc-key-algorithms
docker_env
drawio_rendering
user_permissions
ldap_host_failover
svg_image
prosemirror
captcha_example
fix/video-export
v26.03.4
v26.03.3
v26.03.2
v26.03.1
v26.03
v25.12.9
v25.12.8
v25.12.7
v25.12.6
v25.12.5
v25.12.4
v25.12.3
v25.12.2
v25.12.1
v25.12
v25.11.6
v25.11.5
v25.11.4
v24.11.4
v25.11.3
v25.11.2
v25.11.1
v25.11
v25.07.3
v25.07.2
v25.07.1
v25.07
v25.05.2
v25.05.1
v25.05
v25.02.5
v25.02.4
v25.02.3
v25.02.2
v25.02.1
v25.02
v24.12.1
v24.12
v24.10.3
v24.10.2
v24.10.1
v24.10
v24.05.4
v24.05.3
v24.05.2
v24.05.1
v24.05
v24.02.3
v24.02.2
v24.02.1
v24.02
v23.12.3
v23.12.2
v23.12.1
v23.12
v23.10.4
v23.10.3
v23.10.2
v23.10.1
v23.10
v23.08.3
v23.08.2
v23.08.1
v23.08
v23.06.2
v23.06.1
v23.06
v23.05.2
v23.05.1
v23.05
v23.02.3
v23.02.2
v23.02.1
v23.02
v23.01.1
v23.01
v22.11.1
v22.11
v22.10.2
v22.10.1
v22.10
v22.09.1
v22.09
v22.07.3
v22.07.2
v22.07.1
v22.07
v22.06.2
v22.06.1
v22.06
v22.04.2
v22.04.1
v22.04
v22.03.1
v22.03
v22.02.3
v22.02.2
v22.02.1
v22.02
v21.12.5
v21.12.4
v21.12.3
v21.12.2
v21.12.1
v21.12
v21.11.3
v21.11.2
v21.11.1
v21.11
v21.10.3
v21.10.2
v21.10.1
v21.10
v21.08.6
v21.08.5
v21.08.4
v21.08.3
v21.08.2
v21.08.1
v21.08
v21.05.4
v21.05.3
v21.05.2
v21.05.1
v21.05
v21.04.6
v21.04.5
v21.04.4
v21.04.3
v21.04.2
v21.04.1
v21.04
v0.31.8
v0.31.7
v0.31.6
v0.31.5
v0.31.4
v0.31.3
v0.31.2
v0.31.1
v0.31.0
v0.30.7
v0.30.6
v0.30.5
v0.30.4
v0.30.3
v0.30.2
v0.30.1
v0.30.0
v0.29.3
v0.29.2
v0.29.1
v0.29.0
v0.28.3
v0.28.2
v0.28.1
v0.28.0
v0.27.5
v0.27.4
v0.27.3
v0.27.2
v0.27.1
v0.27
v0.26.4
v0.26.3
v0.26.2
v0.26.1
v0.26.0
v0.25.5
v0.25.4
v0.25.3
v0.25.2
v0.25.1
v0.25.0
v0.24.3
v0.24.2
v0.24.1
v0.24.0
v0.23.2
v0.23.1
v0.23.0
v0.22.0
v0.21.0
v0.20.3
v0.20.2
v0.20.1
v0.20.0
v0.19.0
v0.18.5
v0.18.4
v0.18.3
v0.18.2
v0.18.1
v0.18.0
v0.17.4
v0.17.3
v0.17.2
v0.17.1
v0.17.0
v0.16.3
v0.16.2
v0.16.1
v0.16.0
v0.15.3
v0.15.2
v0.15.1
v0.15.0
v0.14.3
v0.14.2
v0.14.1
v0.14.0
v0.13.1
v0.13.0
v0.12.2
v0.12.1
v0.12.0
v0.11.2
v0.11.1
v0.11.0
v0.10.0
v0.9.3
v0.9.2
v0.9.1
v0.9.0
v0.8.2
v0.8.1
v0.8.0
v0.7.6
v0.7.5
v0.7.4
v0.7.3
0.7.2
v.0.7.1
v0.7.0
v0.6.3
v0.6.2
v0.6.1
v0.6.0
v0.5.0
Labels
Clear labels
🎨 Design
📖 Docs Update
🐛 Bug
🐛 Bug
:cat2:🐈 Possible duplicate
💿 Database
☕ Open to discussion
💻 Front-End
🐕 Support
🚪 Authentication
🌍 Translations
🔌 API Task
🏭 Back-End
⛲ Upstream
🔨 Feature Request
🛠️ Enhancement
🛠️ Enhancement
🛠️ Enhancement
❤️ Happy feedback
🔒 Security
🔍 Pending Validation
💆 UX
📝 WYSIWYG Editor
🌔 Out of scope
🔩 API Request
:octocat: Admin/Meta
🖌️ View Customization
❓ Question
🚀 Priority
🛡️ Blocked
🚚 Export System
♿ A11y
🔧 Maintenance
> Markdown Editor
pull-request
Mirrored from GitHub Pull Request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: starred/BookStack#1138
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @nmehlei on GitHub (Apr 10, 2019).
Describe the feature you'd like
If I understand correctly, database connectivity between BookStack and the MySQL database server is currently not SSL encrypted. This could be supported to enable more security and more use cases. Possibly, the underlying database provider/library already supports it.
Describe the benefits this feature would bring to BookStack users
Allows for more usage scenarios. What might be relevant, the default connection security settings for Azure's MySQL database service offering enforces SSL connection security. Thus I had to disable this to allow BookStack using the database.
@tomaskir commented on GitHub (Apr 28, 2019):
+1 to this - would definitely appreciate a native way to do MySQL TLS connections from BookStack.
You can however already do this.
Here is how our BookStack is setup to use TLS to our Mariadb server:
In
config/database.phpyou need to edit themysqlDB connection section:You can also use
PDO::MYSQL_ATTR_SSL_CERTandPDO::MYSQL_ATTR_SSL_KEYif you want to do client verification using a client cert.@sosamv commented on GitHub (Jan 19, 2021):
Anyone know about this? I've tried this option from @tomaskir but seems like bookstack is ignoring it. I even add error to that database file and keep getting the SSL error. Any clue on what to do?
@sosamv commented on GitHub (Jan 19, 2021):
Ok guys! for anyone having the same problem. You have to refresh laravels cacheeeeee OMG!
php artisan optimize:clear@grasshopper139 commented on GitHub (Nov 2, 2021):
Is there any update on this issue? I modified
app/Config/database.php:Then I cleared the cache by issuing:
php artisan optimize:clearphp artisan cache:clearWhen I run
php artisan migrateI get:I am running Bookstack v21.10.2 on Ubuntu 20.04.
@hovanvydut commented on GitHub (Feb 6, 2022):
I have the same error. Do you have the solution?
Thank you so much.
@bourdaisj commented on GitHub (Feb 9, 2022):
You're missing some PDO attributes.
It could be supported out of the box by creating a bool DB_SSL_CONNECTION variable in the .env, and common pdo ssl attributes.
@ssddanbrown commented on GitHub (Feb 10, 2022):
Just spent a while looking into this after being asked in the BookStack discord.
From my testing, SSL usage is technically currently possible within BookStack using the below
.envoption:This sets the
PDO::MYSQL_ATTR_SSL_CAvalue in the background.The below are assumptions from spending hours testing and tweaking variables. There seems to be a lack of information out there regarding how PHP, PDO, MySQL & SSL entwine. In addition, the errors thrown in failure scenarios, at least with MariaDB, don't provide any information at all as far as I could see.
Setting the above also seems to set the following default option:
From the MySQL docs:
This means that the MySQL server certificate must be using a
Common Namethat matches theDB_HOSTvalue that you use for BookStack. This may also need to match the MySQL server's hostname value but I have not verified this.Upon the above, using
localhostas a hostname appears to fail more commonly than other hostnames/IP addresses when getting involved with SSL verification. This probably won't matter for most cases (Since SSL becomes somewhat redundant if the database is local) but it did cause confusion in my testing.Copy of notes based upon past comments here:
database.phpfile are not considered supported and may break or cause troubles upon update.PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT => falseto thearray_filter([part ofdatabase.phpwon't take any affect since the option would be filtered out right away.If any additional options are definitely required feel free to explain the reason why, but I would like some insight into why they would be needed since I'll need to understand the usage when maintaining/testing things. Upon that, I'd want to know that an option is needed rather than it being added just because it made things work in one instance.
@bourdaisj commented on GitHub (Feb 10, 2022):
PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT => false) but now I don't think thats what he wanted to achieve right?MYSQL_ATTR_SSL_CA="/path/to/ca.pem"works perfectly fine for me, but indeed you cannot use the default mysql certificate CN (it will mismatch with the DB_HOST), or you can add an entry in your /etc/hosts file but it does looks like a nasty hack...The use of
MYSQL_ATTR_SSL_CA="/path/to/ca.pem"could just be added to the documentation but it's not a bookstack-specific think so idk if it's in the scope of the doc...@ssddanbrown commented on GitHub (Feb 11, 2022):
@Julesdevops Sure. Just to confirm my comment above was not in response to you previous comment at all. I was just looking to provide any clarification I can offer regarding existing settings based on my findings. I'm sure there are requirements for other settings but I'd want confirmation of requirement with explanation of use-base before expanding out our remit of support. Your exactly right in that we should add documentation for this option, if the current option is enough for most use-cases.
@hovanvydut commented on GitHub (Feb 11, 2022):
@ssddanbrown Thank you so so much. I have resolved my issue by removing condition in this code
to
Again, I'm very pleased with your help
@MaartenUreel commented on GitHub (Oct 10, 2023):
If I understand the above correctly, there is currently no way to enforce SSL but ignore validation of the certificate?
I am trying to deploy BookStack as a DigitalOcean App usin the LinuxServer.io container. In order to use the managed database service of DigitalOcean, we apparently cannot validate the certificate.
@ssddanbrown commented on GitHub (Oct 10, 2023):
@MaartenUreel It really depends on many factors tbh, this is a messy area, with mulitple layers of "validation" and many different configuration and options involved.
Might depend on what exact "validation" you want to ignore and where SSL is enforced.
You might be able to enforce SSL at a MySQL-user level, can't remember how certs and validation interplay there.
Have you tried using a the DigitalOcean CA cert?
Based upon their docs, it looks like they do provide it: https://docs.digitalocean.com/products/databases/mysql/how-to/connect/#download-the-ssl-encryption
Note: I remember some other users reporting issues about indexes using Digital Ocean hosted MySQL service. Might have been the kind of thing they had to connect support or something to make compatible. Can't remember the detail.
@MaartenUreel commented on GitHub (Oct 10, 2023):
Hey @ssddanbrown; apparently it is not required although it does looks like it in the console. I was able to connect without SSL and indeed I also had to arrange the index setting to allow creation of records without primary keys.
I managed to get it up and running on DO with their managed database and using Spaces as storage layer.