Set up SSL between Google Cloud and Cloud SQL
I've got a WordPress site on GCP Compute Engine and a database which is hosted on Cloud SQL, which works great. My only issue is every time I select "Allow only SSL connections" on the GCP dashboard the site can't connect to the database and I get "Error connecting to database" error.
I have downloaded all the SSL (.pem) files that Google provided when creating the SQL instance. Have followed instructions by John Hanley https://github.com/jhanley-com/wordpress-cloud-sql, as soon as I turn SSL on and it still breaks.
I also have Comodo SSL for the site and Cloudflare setup, unsure if that has anything to do with it.
Have also been looking at Cloud SQL Proxy but unsure how to set that up or if it's better or worse than the above solution...
Have been instructed by John Hanley to create a new question so he can assist.
Thanks in advance.
Solutions
When you create a new client certificate [1] the three files you are asked to download (server-ca.pem, client-cert.pem, client-key.pem) are the values for the --ssl-ca, --ssl-cert, and --ssl-key command options
E.g: mysql --ssl-ca=server-ca.pem --ssl-cert=client-cert.pem --ssl-key=client-key.pem --host=[instance-ip] --user=root --password
If it cannot find them you will receive errors such as: SSL connection error: SSL_CTX_set_default_verify_paths failed error.
Those files will have to be present in the VM directory the command is being run for the Instance to verify the credentials to connect. Remember to have Only secured connection (SSL connection) activated for it to work.
Bear in mind that the Compute Engine instance should be in the same region with your Cloud SQL instance. Please proceed and try this example, in order to eliminate the possibility of misconfiguration[1].
If you still get error, tell us how how did you enforce the SSL connections? Looks like follow Google’s documentation about it [2], right? If so, did you do it through the console, gcloud command or cURL?
About the Cloud SQL Proxy [3] is an option to access your Cloud SQL Second Generation instances without having to whitelist IP addresses or configure SSL.
Sincerely,
[1] - https://cloud.google.com/sql/docs/mysql/connect-compute-engine [2] - https://cloud.google.com/sql/docs/mysql/configure-ssl-instance#enforcing-ssl [3] - https://cloud.google.com/sql/docs/mysql/connect-compute-engine#gce-connect-proxy