17

This is the warning when I open my phpMyAdmin's login (index) page:

There is mismatch between HTTPS indicated on the server and client.
This can lead to non working phpMyAdmin or a security risk.
Please fix your server configuration to indicate HTTPS properly.

The error should be caused by a loadbalancer in between my client and phpmyadmin itself. SSL terminates on the loadbalancer so the URL being used (that phpmyadmin receives in request headers, I assume) is https://mydomain/phpmyadmin.

The loadbalancer communicates with phpmyadmin via http, so the URL being used between lb and pma is http://mydomain/phpmyadmin (not https).

I found this very fitting article on github: Possibility to deactivate SSL connection #170 which is for Docker containers and describes an env var to be passed to the container called "PMA_ABSOLUTE_URI" to fix the problem.

Which setting would this be in phpmyadmin NON Docker?

Any other solution to my problem is also highly appreciated.

Sidenote: Phpmyadmin works fine after the login. You can log in, there are no warnings after the log in and you can perform all interactions without problems. I am just worried about the warning.

1 Answer 1

40

I have exactly the same setup as you are describing. A front load balancer acts as reverse proxy and also as SSL/TLS terminator. The LB talks in plain http with the backend server where phpMyAdmin is running.

When I upgraded from 4.0.4.1 to 4.9.0.1 I got the same warning appearing at the phpMyAdmin login screen as you. I was able to solve this on the reverse proxy by "faking" the protocol from http to https. In my case my reverse proxy is a Nginx web server and just before I'd pass to the backend server, I added X-Forwarded-Proto:

 server {
  listen 443;
  server_name my.phpmyadmin.example.com;

[... log and ssl settings ...]

  location / {
    include /etc/nginx/proxy.conf;
    proxy_set_header X-Forwarded-Proto https;
    proxy_pass http://backendserver;
  }
}

By adding proxy_set_header X-Forwarded-Proto https; this tells the backend server that the client to proxy communication happens over https. Without setting this header, phpMyAdmin probably identifies (not sure, just a guess) that it was loaded on a https:// URL yet the communication (between reverse proxy and phpMyAdmin server) happened over http. Therefore it's a correct warning to be shown.

As soon as Nginx was reloaded, the warning disappared from the phpMyAdmin login screen.

4
  • I see, interesting. I will see if I can give this a try (as the loadbalancer is not under my control and most likely not an nginx but some enterprise-monster) but I will let the hoster know and see if we can get that done. Thanks for the hint!
    – Worp
    Commented Aug 28, 2019 at 8:20
  • @Worp in general a reverse proxy (open source, enterprise, or else) should be capable to add HTTP headers. In this particular case this would be the X-Forwarded-Proto: https header. Commented Aug 28, 2019 at 10:48
  • Brilliant, thank you. This worked like a charm when running PMA on Docker via Nginx reverse proxy.
    – user743873
    Commented Mar 30, 2021 at 9:10
  • 2
    proxy_set_header X-Forwarded-Proto $scheme; would handle both http or https accordingly.
    – synkro
    Commented Dec 10, 2021 at 0:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.