Symfony version(s) affected

7.1.2

Description

My application is connecting to a SQL Server database and also using it for session storage. I was using ODBC Driver 17 but recently upgraded to 18, which now defaults to enabling encryption.

Without any changes, I get the following error:

SQLSTATE[08001]: [Microsoft][ODBC Driver 18 for SQL Server]SSL Provider: [error:0A000086:SSL routines::certificate verify failed:unable to get local issuer certificate]

For Doctrine, I can make it work by adding a new optionTrustServerCertificate to mydoctrine.yaml file:

connections:    default:        url: '%env(resolve:DATABASE_URL)%'        options:            TrustServerCertificate: yes

But I still get the error when Symfony tries to connect to the database for the session.

I've tried everything I could think of to pass theTrustServerCertificate option toPdoSessionHandler but nothing seems to work. Here's the relevant portion of myservices.yaml file:

 Symfony\Component\HttpFoundation\Session\Storage\Handler\PdoSessionHandler:     arguments:         - '%env(DATABASE_URL)%'         - { db_table: 'Session', db_id_col: 'ID', db_data_col: 'Data', db_time_col: 'Time', db_lifetime_col: 'ExpiresAt', lock_mode: 0, db_connection_options: { TrustServerCertificate: 'yes' } }

I've triedTrustServerCertificate: 'yes',TrustServerCertificate: 1,TrustServerCertificate: true. I've added?TrustServerCertificate=yes (as well as1 andtrue) to my database URL. Nothing I tried has worked.

Either I'm missing something or the extra options aren't taking any effect.

How to reproduce

Connect to a SQL Server database for sessions using the ODBC Driver 18

Possible Solution

The only way I've gotten the session connection to work was to manually edit the code inPdoSessionHandler, in thebuildDsnFromUrl method, I add$dsn .= ';TrustServerCertificate=yes'; right before it returns$dsn.

If you look at how Doctrine does it invendor/doctrine/dbal/src/Driver/PDO/SQLSrv/Driver.php, all the extra options are appended to the DSN. So probablyPdoSessionHandler could do something similar, e.g. if I have?TrustServerCertificate=yes&Foo=bar in my database URL then it could add;TrustServerCertificate=yes;Foo=bar to the DSN.

Additional Context

No response