使用 TLS 连接 MySQL

<?php
ini_set ('error_reporting', E_ALL);
ini_set ('display_errors', '1');
error_reporting (E_ALL|E_STRICT);

assert_options(ASSERT_ACTIVE, true);
assert_options(ASSERT_WARNING, true);
assert_options(ASSERT_BAIL, true);

$sMySqlHost = 'mysqlserver'; //TODO
$iMySqlPort = 3306;
$sMySqlUser = 'user'; //TODO
$sMySqlPassword = 'password'; //TODO
$iMySqlFlag = MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT;
$sTlsKey = '/var/mysql/client-key.pem'; //TODO 修正为正确的值，如未使用则设为 null
$sTlsCert = '/var/mysql/client-cert.pem'; //TODO 修正为正确的值，如未使用则设为 null
$sTlsCa = '/var/mysql/ca.pem'; //TODO 修正为正确的值，如未使用则设为 null

assert(is_readable($sTlsKey), 'Can\'t open SSL Key file');
assert(is_readable($sTlsCert), 'Can\'t open SSL Cert file');
assert(is_readable($sTlsCa), 'Can\'t open SSL CA file');

echo "Trying to connect using :\n host=$sMySqlHost, user=$sMySqlUser, port=$iMySqlPort\n";
echo "TLS options :\n key=$sTlsKey\n cert=$sTlsCert\n ca=$sTlsCa\n";

$oMysqli = new mysqli();
$oMysqli->init();
$oMysqli->ssl_set($sTlsKey, $sTlsCert, $sTlsCa, NULL, NULL);
$oMysqli->real_connect($sMySqlHost, $sMySqlUser, $sMySqlPassword, null, $iMySqlPort, NULL, $iMySqlFlag);

if ($oMysqli->connect_errno)
{
        die ('Connect error (' . mysqli_connect_errno() . '): ' . mysqli_connect_error() . "\n");
} else {
        if (!IsOpenedDbConnectionUsingTls($oMysqli)) {
                $oMysqli->close();
                die ('The connection can be opened but is not TLS encrypted !');
        }

        echo "Successfully connected using TLS !\n";

        $sTlsCipherValue = GetMySqlVarValue($oMysqli, 'ssl_cipher');
        $sTlsVersionValue = GetMySqlVarValue($oMysqli, 'ssl_version');
        echo "TLS cipher=$sTlsCipherValue\n";
        echo "TLS version=$sTlsVersionValue\n";

        $oMysqli->close();
}

/**
 * <p>DB 连接可以在没有加密的情况下透明地打开（没有抛出错误），即使使用了 TLS 参数。<br>
 * 可以调用此方法来确保 DB 连接确实使用了 TLS。
 *
 * <p>我们使用此对象连接：{@link self::$m_oMysqli}
 *
 * @param \mysqli $oMysqli
 *
 * @return boolean true if the connection was really established using TLS
 * @throws \MySQLException
 *
 * @uses IsMySqlVarNonEmpty
 */
function IsOpenedDbConnectionUsingTls($oMysqli)
{
        $bNonEmptySslVersionVar = IsMySqlVarNonEmpty($oMysqli, 'ssl_version');
        $bNonEmptySslCipherVar = IsMySqlVarNonEmpty($oMysqli, 'ssl_cipher');

        return ($bNonEmptySslVersionVar && $bNonEmptySslCipherVar);
}

/**
 * @param \mysqli $oMysqli
 * @param string $sVarName
 *
 * @return bool
 * @throws \MySQLException
 *
 * @uses GetMySqlVarValue
 */
function IsMySqlVarNonEmpty($oMysqli, $sVarName)
{
        $sResult = GetMySqlVarValue($oMysqli, $sVarName);

        return (!empty($sResult));
}

/**
 * @param \mysqli $oMysqli
 * @param string $sVarName
 *
 * @return string
 * @throws \MySQLException
 *
 * @uses 'SHOW STATUS' queries
 */
function GetMySqlVarValue($oMysqli, $sVarName)
{
        $oResults = $oMysqli->query("SHOW SESSION STATUS LIKE '$sVarName'", 1);

        if ($oResults === false) {
                return false;
        }

        $aResults = $oResults->fetch_array(MYSQLI_NUM);
        $sResult = $aResults[1];

        return $sResult;
}

SELECT Version()

SELECT @@version