How to secure traffic between site and MySQL?

[DavidRock]

Happy Holidays -
We have a website hosted at a public ISP that uses PHP to store data in a MySQL db. The MySQL db is hosted at the same ISP as the site. And we have an SSL key installed at the ISP to encrypt traffic between our site and a client's browser. We want to change this setup by moving our MySQL data from the ISP to a new MySQL server that we have in our office. In this new scenario the traffic between a client's browser and our website would still be encrypted but what do we need to do in order to encrypt the traffic between our website and our new MySQL server hosted by us? It seems like we will need to install another SSL key on our new MySQL server (a FreeBSD machine) but not sure exactly what we need to do to get the website talking securely to the db. Any advice or direction to further reading is much appreciated.

Thanks,
David Rock

 

[GiaBetiu]

You need to create a Public Key infrastructure.
Define what CA type you want to use: private or public or both.
Indeed use SSL. Define the way to assisgn certificate(s)-users (as it is in IIS you can have one-to-many or many-to many).
As about the way your web server will have a dialog under SSL, few things:
- the user account used for webserver will have a certificate
- the SQL server should know how to use SSL (I don't know how MySQL can do this)
- when webserver is accessing information from SQL will be identified by that certificate.

Now, internet users if you want to let them a secure access to the webserver, then the best way is to use for them a public CA (will give trust), and a way to assign those certificates to those internet users (eg: a form, then an email with the certificate).
Those certificates will give right to the internet users into your webserver application. That's all that you need. For SQL, any request will come impersonate (with the webserver account and its private certificate).

Good,... sorry if I puzled you, but that's few things about a secure web connection + n-tier application.
Gia Betiu
giabetiu@chello.nl
Computer Eng. CNE 4, CNE 5, soon MCSE2k