what does the mysqli real connect MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT flag do? How to disable only CN validation?
[email protected] (John Wythe) Wed, 22 Mar 2023 20:50:48 +0000
| Newsgroups | php.db |
|---|---|
| Message-ID | <SJ0PR18MB4012819BDBD30EFD5C8607ECAA869@SJ0PR18MB4012.namprd18.prod.outlook.com> |
--_004_SJ0PR18MB4012819BDBD30EFD5C8607ECAA869SJ0PR18MB4012namp_ Content-Type: multipart/alternative; boundary="_000_SJ0PR18MB4012819BDBD30EFD5C8607ECAA869SJ0PR18MB4012namp_" --_000_SJ0PR18MB4012819BDBD30EFD5C8607ECAA869SJ0PR18MB4012namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable mysqli_real_connect has a parameter called flags than can be passed to it. = One of the flags in MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT. What does this flag do? Does it only disable the CN validation, or does it= also disable the certificate validation against a CA authority. SSL_CONEXT talks about options peer_name peer_verify peer_verify_name I would like to use these to at least disable only the verify_name part, or= maybe even set the peer_name and have both validations turned on. Seems this context function is only available for streams and not mysqli. Openssl seems to have the ability to do this, however it does not appear to= be exposed via mysqli. I am guessing the flag above equates to peer verif= y and not peer_verify_name, or equates to both. I suppose I could download the source for php_pmysqli, and have a look, wou= ld that be the correct package to look at? John Wythe Software & Systems Engineer Epicor Software Corporation www.epicor.com<http://www.epicor.com/> Ph: 250-260-6495 TF Support: 800-678-7423 E-Mail: [email protected] Support E-Mail: [email protected]<mailto:[email protected]> Support portal: https://epicorcs.service-now.com/epiccare/ [cid:[email protected]]<http://www.epicor.com/services/default= .aspx> --_000_SJ0PR18MB4012819BDBD30EFD5C8607ECAA869SJ0PR18MB4012namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:= //www.w3.org/TR/REC-html40"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)"> <!--[if !mso]><style>v\:* {behavior:url(#default#VML);} o\:* {behavior:url(#default#VML);} w\:* {behavior:url(#default#VML);} .shape {behavior:url(#default#VML);} </style><![endif]--><style><!-- /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; font-size:11.0pt; font-family:"Calibri",sans-serif;} span.EmailStyle17 {mso-style-type:personal-compose; font-family:"Calibri",sans-serif; color:windowtext;} .MsoChpDefault {mso-style-type:export-only; font-family:"Calibri",sans-serif;} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--> </head> <body lang=3D"EN-US" link=3D"#0563C1" vlink=3D"#954F72" style=3D"word-wrap:= break-word"> <div class=3D"WordSection1"> <p class=3D"MsoNormal"><span style=3D"font-size:14.0pt">mysqli_real_connect= has a parameter called flags than can be passed to it. One of the fl= ags in </span><b><span style=3D"font-size:10.0pt;font-family:"Courier New&quo= t;;color:#333333;background:#E6E6E6">MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_C= ERT.</span></b><b><span style=3D"font-size:10.0pt;color:#333333;background:= #E6E6E6"><o:p></o:p></span></b></p> <p class=3D"MsoNormal"><span style=3D"font-size:14.0pt"><o:p> </o:p></= span></p> <p class=3D"MsoNormal"><span style=3D"font-size:14.0pt">What does this flag= do? Does it only disable the CN validation, or does it also disable = the certificate validation against a CA authority.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:14.0pt"><o:p> </o:p></= span></p> <p class=3D"MsoNormal"><span style=3D"font-size:14.0pt">SSL_CONEXT talks ab= out options<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:14.0pt"><o:p> </o:p></= span></p> <p class=3D"MsoNormal"><span style=3D"font-size:14.0pt">peer_name<o:p></o:p= ></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:14.0pt">peer_verify<o:p></o= :p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:14.0pt">peer_verify_name<o:= p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:14.0pt"><o:p> </o:p></= span></p> <p class=3D"MsoNormal"><span style=3D"font-size:14.0pt">I would like to use= these to at least disable only the verify_name part, or maybe even set the= peer_name and have both validations turned on.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:14.0pt"><o:p> </o:p></= span></p> <p class=3D"MsoNormal"><span style=3D"font-size:14.0pt">Seems this context = function is only available for streams and not mysqli.<o:p></o:p></span></p= > <p class=3D"MsoNormal"><span style=3D"font-size:14.0pt"><o:p> </o:p></= span></p> <p class=3D"MsoNormal"><span style=3D"font-size:14.0pt">Openssl seems to ha= ve the ability to do this, however it does not appear to be exposed via mys= qli. I am guessing the flag above equates to peer verify and not peer= _verify_name, or equates to both.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:14.0pt"><o:p> </o:p></= span></p> <p class=3D"MsoNormal"><span style=3D"font-size:14.0pt">I suppose I could d= ownload the source for php_pmysqli, and have a look, would that be the corr= ect package to look at?<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:14.0pt"><o:p> </o:p></= span></p> <p class=3D"MsoNormal"><span style=3D"font-size:14.0pt"><o:p> </o:p></= span></p> <p class=3D"MsoNormal"><span style=3D"font-size:9.0pt;font-family:"Ari= al",sans-serif">John Wythe<br> Software & Systems Engineer<br> Epicor Software Corporation<br> <a href=3D"http://www.epicor.com/"><span style=3D"color:blue">www.epicor.co= m</span></a><o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:9.0pt;font-family:"Ari= al",sans-serif">Ph: 250-260-6495<br> TF Support: 800-678-7423<br> E-Mail: [email protected]<br> Support E-Mail: <u><span style=3D"color:#1F497D"><a href=3D"mailto:SilkSupp= [email protected]"><span style=3D"color:blue">[email protected]</span></a= ></span></u><o:p></o:p></span></p> <p class=3D"MsoNormal"><b><span style=3D"font-size:14.0pt;font-family:"= ;Arial",sans-serif">Support portal:</span></b><b><span style=3D"font-s= ize:14.0pt"> </span></b><b><u><span style=3D"font-size:14.0pt;font-family:"Arial&qu= ot;,sans-serif;color:#0070C0"><a href=3D"https://epicorcs.service-now.com/e= piccare/"><span style=3D"color:blue">https://epicorcs.service-now.com/epicc= are/</span></a></span></u></b><b><span style=3D"font-size:14.0pt;font-famil= y:"Arial",sans-serif;color:#1F497D"><o:p></o:p></span></b></p> <p class=3D"MsoNormal" style=3D"mso-margin-top-alt:auto;mso-margin-bottom-a= lt:auto;line-height:12.0pt"> <a href=3D"http://www.epicor.com/services/default.aspx" target=3D"_blank"><= span style=3D"font-size:9.0pt;font-family:"Arial",sans-serif;colo= r:blue;text-decoration:none"><img border=3D"0" width=3D"518" height=3D"71" = style=3D"width:5.4in;height:.7416in" id=3D"Picture_x0020_1" src=3D"cid:imag= [email protected]"></span></a><span style=3D"font-size:12.0pt;font= -family:"Times New Roman",serif"><o:p></o:p></span></p> <p class=3D"MsoNormal"><o:p> </o:p></p> </div> </body> </html> --_000_SJ0PR18MB4012819BDBD30EFD5C8607ECAA869SJ0PR18MB4012namp_-- --_004_SJ0PR18MB4012819BDBD30EFD5C8607ECAA869SJ0PR18MB4012namp_--