Addressed in 5.3.3

To open a bug, commit the same wrong thing and close the bug does not solve anything. I mailed you what I'm expecting.

You need to start the MySQL server with the following options :
ssl-ca=/path/to/cacert.pem
ssl-cert=/path/to/server-cert.pem
ssl-key=/path/to/server-key.pem

All files you can find here:
http://www.hristov.com/andrey/projects/php_stuff/certs/

Pierre, I haven't committed the same wrong thing. I thought you can read emails/diffs, but somehow I lost this feeling.

Here is the new patch, already committed, also to be found in the commit email.

Index: ext/openssl/openssl.c
===================================================================
--- ext/openssl/openssl.c	(revision 298371)
+++ ext/openssl/openssl.c	(working copy)
@@ -4445,6 +4445,7 @@
 		EVP_PKEY *key = NULL;
 		SSL *tmpssl;
 		char resolved_path_buff[MAXPATHLEN];
+		const char * private_key = NULL;
 
 		if (VCWD_REALPATH(certfile, resolved_path_buff)) {
 			/* a certificate to use for authentication */
@@ -4452,10 +4453,21 @@
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to set local cert chain file `%s'; Check that your cafile/capath settings include details of your certificate and its issuer", certfile);
 				return NULL;
 			}
+			GET_VER_OPT_STRING("local_pk", private_key);
 
-			if (SSL_CTX_use_PrivateKey_file(ctx, resolved_path_buff, SSL_FILETYPE_PEM) != 1) {
-				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to set private key file `%s'", resolved_path_buff);
-				return NULL;
+			if (private_key) {
+				char resolved_path_buff_pk[MAXPATHLEN];
+				if (VCWD_REALPATH(private_key, resolved_path_buff_pk)) {
+					if (SSL_CTX_use_PrivateKey_file(ctx, resolved_path_buff_pk, SSL_FILETYPE_PEM) != 1) {
+						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to set private key file `%s'", resolved_path_buff_pk);
+						return NULL;
+					}
+				}
+			} else {
+				if (SSL_CTX_use_PrivateKey_file(ctx, resolved_path_buff, SSL_FILETYPE_PEM) != 1) {
+					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to set private key file `%s'", resolved_path_buff);
+					return NULL;
+				}		
 			}
 
 			tmpssl = SSL_new(ctx);

Pierre/Andrey

Are we happy that this bug is fixed? The context option that was added by the patch is not currently documented. I will be helping to update the documentation for the recent OpenSSL changes, can I include this in the docs as well?

Thanks, Chris

> The user is forced to put keys in the same file,
> which is not always possible.

I'm drawing a blank on when this would not be possible. The only thing that needs to happen in order for this to work is the concatenation of the private key and the public cert into the same file.

Are there scenarios where this isn't possible that I'm missing? Otherwise I wouldn't really consider this a bug.

Closing, since this is fixed as of PHP 5.3.3 (IOW, the commit never had been reverted).