WordFence fails to connect to MySQL via mysqli if DB_USER requires SSL

Hello @ianackerwines and thanks for reaching out to us!

I have seen a similar issue in the past with SSL and mysqli storage.

Can you send a diagnostic report to wftest @ wordfence . com? You can find the link to do so at the top of the Wordfence Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

Thanks!

Sure, I’ll send a report shortly. In the meantime, the following modification to the mysql.php -> connect() function resolves the issue for us, in case that leads to a more general solution (we are in AWS, so the cert referenced is the RDS SSL certificate pulled from https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem):

public function connect($user, $password, $database, $host, $port = null, $socket = null) {
	// ############## BEGIN CUSTOMIZATION ############## /
    $connection = mysqli_init();
    $connection->ssl_set(NULL, NULL, '/var/app/current/certs/rds-combined-ca-bundle.pem', NULL, NULL);
	$this->dbh =  $connection->real_connect($host, $user, $password, $database, $port, $socket);
	// ############## END CUSTOMIZATION ############## /
	if (!$this->dbh) {
		$error = error_get_last();
		throw new wfWAFStorageEngineMySQLiException('Unable to connect to database: ' . $error['message'], $error['type']);
	}

	return $this->dbh;
}

@wfadam Since the plugin can’t be activated using this configuration, I don’t have a WordFence WP-Admin section from which to pull Diagnostics. I’ll try activating the plugin using the workaround code mentioned above, and then changing back to the old code so that the WordFence WP-Admin section exists but WordFence fails to load, and will try to send diagnostics from that setup.

@wfadam Unfortunately it isn’t possible to generate diagnostics in this situation. If I manually revert the mysql.php file with a previously-activated and functioning WordFence installation, what happens is a fatal error trying to load the site (due to auto-prepend attempting to load the config). In the http error logs I can see same “Unable to connect to database…” error I mentioned in my original post.

Thanks for providing that information to us!

I checked with our QA team and it seems that this is a current known issue and they are working on resolving it.

For now, your workaround should work just fine until it’s resolved.

Let me know if you have any more questions!

Thanks!