PHP access denied for MySQL SHA256 Accounts - php

Question

I've compiled OpenSSL 1.0.2h into /usr/local/openssl on a MySQL 5.7.13 Server, using the following code:
tar xvzf openssl-1.0.2h.tar.gz -C /usr/local
cd /usr/local/openssl-1.0.2h
./config --prefix=/usr/local/openssl shared
make depend
make
make install
After, I configured MySQL with:
cmake . -DMYSQL_DATADIR=/usr/local/mysql/dat -DWITH-SSL=/usr/local/openssl
When MySQL starts for the first time, it creates eight key/cert (.pem) files within that /dat directory:
ca.pem
ca-key.pem
client-cert.pem
client-key.pem
private_key.pem
public_key.pem
server-cert.pem
server-key.pem
From within MySQL Workbench, I can see that SSL is on in the Available Server Features:
SSL Availability On (Green Dot)
And that the SHA256/SSL files are identified in the Authentication section:
SHA256 password private key: private_key.pem
SHA256 password public key: public_key.pem
SSL CA: ca.pem
SSL CA path: n/a
SSL Cert: server-cert.pem
SSL CRL: n/a
SSL CRL path: n/a
SSL Key: server-key.pem
From the Users and Privileges section in Workbench I have created two test users:
'user_standard'#'%' picking Standard for Authentication Type
'user_sha256'#'%' picking SHA256 Password for Authentication Type
In my my.cnf file I specify the following:
[client]
ssl-ca = /usr/local/mysql/dat/ca.pem
ssl-cert = /usr/local/mysql/dat/client-cert.pem
ssl-key = /usr/local/mysql/dat/client-key.pem
[mysqld]
ssl-ca = /usr/local/mysql/dat/ca.pem
ssl-cert = /usr/local/mysql/dat/server-cert.pem
ssl-key = /usr/local/mysql/dat/server-key.pem
ssl-cipher = DHE-RSA-AES256-SHA
The "status" of the MySQL Server is as follows:
mysql> status
--------------
./bin/mysql Ver 14.14 Distrib 5.7.13, for Linux (x86_64) using EditLine wrapper
Connection id: 4
Current database: mysql
SSL: Cipher in use is DHE-RSA-AES256-SHA
Current page: stdout
Using outfile: ''
Using delimiter: ;
Server version: 5.7.13-debug-log Source distribution
Protocol version: 10
Connection: Localhost via UNIX socket
Server characterset: utf8
Db characterset: utf8
Client characterset: utf8
Conn. characterset: utf8
UNIX socket: /tmp/mysqld.sock
I have a separate client server running Apache 2.4.10 (configured with --with-ssl=/usr/local/openssl), PHP 7.0.7 (configured with --with-openssl=/usr/local/openssl), and the same OpenSSL 1.0.2h (configured with --prefix=/usr/local/openssl shared). My phpinfo.php file shows OpenSSL support is enabled and that its Library/Header Version is indeed 1.0.2h.
I then copied the ca.pem, server-cert.pem, and server-key.pem files from the MySQL Server to the Apache/PHP Server and made a directory to put them in: /usr/local/openssl/ssl/mysql/.
Here is my PHP code that is a "Success!" using the credentials for [user_standard] but I get,
Warning: mysqli_real_connect(): (HY000/1045): Access denied for user 'user_sha256' (using password: YES)
simply switching the $user and $pass variables to log in as [user_sha256]. Everything else remains the same.
$conn = mysqli_init();
$conn->options (MYSQLI_OPT_SSL_VERIFY_SERVER_CERT, true);
$conn->ssl_set ('/usr/local/openssl/ssl/mysql/server-key.pem', '/usr/local/openssl/ssl/mysql/server-cert.pem', '/usr/local/openssl/ssl/mysql/ca.pem', NULL, 'DHE-RSA-AES256-SHA');
$serv = 'MySQL_Server_5.7.13_Auto_Generated_Server_Certificate';
$user = 'user_standard'; // Switching to 'user_sha256' = Permission denied
$pass = 'user_standard'; // Switching to 'user_sha256' = Permission denied
$data = 'test';
$conn->real_connect ($serv, $user, $pass, $data, 3306, NULL, MYSQLI_CLIENT_SSL);
if (!$conn) {
die ('Connect error (' . mysqli_connect_errno(). '): ' . mysqli_connect_error() . "\n");
} else {
echo "Success!";
}
$conn->close();
I don't understand the difference and/or what possibly needs to be configured differently to allow PHP to connect to the SHA256 account.
And by the way, both the MySQL Server and the Apache/PHP Server are: CentOS Linux release 7.2.1511 (Core).