MySQLi SSL verify

[puschie286]

I found some problems with the ssl verify -> currently you apply the "ssl_verify" config with the "options" method. This seems not to work for the new mysql version.

my workaround is to apply the config by set client_flag to MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT or MYSQLI_CLIENT_SSL_VERIFY_SERVER_CERT.

dont know if this is always required to establish a ssl connection but it was the only possible way for us

Context

• OS: Win10
• Web server: Apache 2.4.29_64
• PHP version: 7.2.3_64
• MySQL Server: 8.0.12_64

[atishhamte]

There are no changes made by the MySQL community in MySQL 8 implementation in case of mysql_real_connect with SSL.
If the code flow works for MySQL 5.7 then it should work with MySQL 8 as well.

The changes asked by @puschie286 are already there in the code like setting a VERIFY and DONT VERIFY,

if (is_array($this->encrypt))
{
    $ssl                                                  = [];
    empty($this->encrypt['ssl_key']) || $ssl['key']       = $this->encrypt['ssl_key'];
    empty($this->encrypt['ssl_cert']) || $ssl['cert']     = $this->encrypt['ssl_cert'];
    empty($this->encrypt['ssl_ca']) || $ssl['ca']         = $this->encrypt['ssl_ca'];
    empty($this->encrypt['ssl_capath']) || $ssl['capath'] = $this->encrypt['ssl_capath'];
    empty($this->encrypt['ssl_cipher']) || $ssl['cipher'] = $this->encrypt['ssl_cipher'];
    if (! empty($ssl))
    {
        if (isset($this->encrypt['ssl_verify']))
        {
            if ($this->encrypt['ssl_verify'])
            {
                defined('MYSQLI_OPT_SSL_VERIFY_SERVER_CERT') &&
                    $this->mysqli->options(MYSQLI_OPT_SSL_VERIFY_SERVER_CERT, true);
            }
            // Apparently (when it exists), setting MYSQLI_OPT_SSL_VERIFY_SERVER_CERT
            // to FALSE didn't do anything, so PHP 5.6.16 introduced yet another
            // constant ...
            //
            // https://secure.php.net/ChangeLog-5.php#5.6.16
            // https://bugs.php.net/bug.php?id=68344
            elseif (defined('MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT'))
            {
                $this->mysqli->options(MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT, true);
            }
        }
        $client_flags |= MYSQLI_CLIENT_SSL;
        $this->mysqli->ssl_set(
            $ssl['key'] ?? null, $ssl['cert'] ?? null, $ssl['ca'] ?? null,
            $ssl['capath'] ?? null, $ssl['cipher'] ?? null
        );
    }
}

[puschie286]

you have it as option but not as flag.
MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT is a connection flag not an option
only MYSQLI_OPT_SSL_VERIFY_SERVER_CERT is an option

https://www.php.net/manual/de/mysqli.options.php
https://www.php.net/manual/de/mysqli.real-connect.php

[puschie286]

not sure why but we also use MYSQLI_CLIENT_SSL_VERIFY_SERVER_CERT instead of MYSQLI_CLIENT_SSL flag