php - 仅使用 SSL 服务器证书连接到 MySQL

Question

我必须从旧的 PHP 5.3.3 应用程序连接到 MySQL 8。我无权升级 PHP 版本。

要求是连接必须通过 SSL 但不能使用 SSL 身份验证。MySQL 服务器配置为使用密码进行连接，但根本不需要客户端提供任何 SSL 身份验证证书。

我使用控制台命令来验证 SSL 连接从我的机器到服务器是否有效：

mysql -u username -p -h domain.com --ssl-mode=REQUIRED

mysql> \s
SSL:                    Cipher in use is DHE-RSA-AES128-GCM-SHA256

mysql> SHOW STATUS LIKE 'Ssl_cipher';
+---------------+---------------------------+
| Variable_name | Value                     |
+---------------+---------------------------+
| Ssl_cipher    | DHE-RSA-AES128-GCM-SHA256 |
+---------------+---------------------------+
1 row in set (0.05 sec)

因此，当前连接使用服务器证书加密，并在没有任何 CA 验证的情况下静默接受它。

然后我尝试使用 mysqli 在 PHP 中重现它：

$mysqli = mysqli_init();

// I've no idea how to tell PHP to ignore all certificates but still use SSL as provided by the server;
// even passing random crap to ssl_set() doesn't change anything at all - not even failed connection
$mysqli->ssl_set(null, null, null, null, null);

$mysqli->real_connect($mysqliDomain, "username", "pass", "db", "3306", null, MYSQLI_CLIENT_SSL);
// Not sure about MYSQLI_CLIENT_SSL - PHP doc says it shouldn't be used from application side; but it doesn't work anyway, no matter if I use it or not.
// In addtion, disabling server cert verification MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT
// is not supported in PHP 5.3.3

$res = $mysqli->query("SHOW STATUS LIKE 'Ssl_cipher';");
while ( $row = $res->fetch_array() ) {
    print_r($row);
}

无论我尝试什么，结果都是空密码值，这意味着连接未加密：

Array ( [0] => Ssl_cipher [Variable_name] => Ssl_cipher [1] => [Value] => )

如何解决这个问题？

标签： phpmysqlssl