Cant accesss OpenSSL eNULL ciphers in PHP

Question

For my current Project I need to communicate with a mosquito MQTT broker via TLS. The communication must be authenticated via a certificate and not encrypted. For that usecase there are available ciphers in openSSL for no authentication = aNULL and for no encryption eNULL I should use NULL-SHA256 with is clasified as eNULL. You can check the available ones like this:

openssl ciphers  eNULL

for me the result is:

ECDHE-RSA-NULL-SHA:ECDHE-ECDSA-NULL-SHA:GOST2012256-NULL-STREEBOG256:GOST2001-NULL-GOST94:AECDH-NULL-SHA:NULL-SHA256:NULL-SHA:NULL-MD5

In PHP you can check the available ciphers by calling openssl_get_cipher_methods() my result array looks kind of similar to the one described at php.net containing 144 strings.

 array:144 [
  0 => "aes-128-cbc"
  1 => "aes-128-cbc-hmac-sha1"
  2 => "aes-128-ccm"     
  ...
  141 => "sm4-ctr"
  142 => "sm4-ecb"
  143 => "sm4-ofb"
  ]

But there are no NULL ciphers available. I tried to overwrite them in the request that is send to the server

stream_context_create([
"ssl" => [
      "ciphers" => "ECDHE-RSA-NULL-SHA:ECDHE-ECDSA-NULL-SHA:AECDH-NULL-SHA:NULL-SHA256:NULL-SHA:NULL-MD5",
      ...
   ],
]

but looking in to wireshark: wiresharc request tls cipers the options are ignored and some other 4 cipers are send.

I researched the php documentation and some onle forums to get this: in the used php build the --with-system-ciphers flag must be used, to allow for php to use the ciphers that openSLL on the host system provides. I looked in to available docker builds with that configuaration and found that the alpine-linux php package uses that flag on line 349

Executing my php script inside the container gave me 133 ciphers as result for openssl_get_cipher_methods() without any NULL ciphers.

I found that the ALL option for openSSL ciphers explisitly doesn't include the eNULL ciphers. This makes me belive that PHP cant access those NULL ciphers as there is no parameter for openssl_get_cipher_methods() to specify that i want NULL ciphers and not ALL.

Is there any knowledge about this problem on SE? How can i change the available ciphers in PHP to cantain NULL cipers? Is there a different way to connect to MQTT in PHP?

EDIT: As People reply with comments that trying to do what i do is stupid, please be aware that I am aware of that. It is my job and i can assure you that i want and need that. The Server expects me to do that and the networke is secure.

Cant accesss OpenSSL eNULL ciphers in PHP

0 Answers