WL#12903: Support compilation with OpenSSL 1.1.1 for MYSQL 5.6 & 5.7

Ramil Kalimullin · Ramil Kalimullin · commit 472b73ec0d76 · 2019-08-27T11:39:37.000+04:00
RB: 22486
diff --git a/cmake/ssl.cmake b/cmake/ssl.cmake
@@ -126,6 +126,7 @@ MACRO (MYSQL_CHECK_SSL)
         # OpenSSL-1.1 requires backport of the patch for
         # Bug #28179051: ADD SUPPORT FOR OPENSSL 1.1 ON WINDOWS
         # SET(WITH_SSL_PATH "C:/OpenSSL-1.1-Win64/")
+        SET(WITH_SSL_PATH "C:/Program Files/OpenSSL-Win64/")
       ENDIF()
     ENDIF()
 
@@ -251,7 +252,7 @@ MACRO (MYSQL_CHECK_SSL)
       ENDIF()
       MESSAGE(STATUS "SSL_LIBRARIES = ${SSL_LIBRARIES}")
       IF(WIN32 AND WITH_SSL STREQUAL "system")
-        MESSAGE(STATUS "Please do\nPATH=${WITH_SSL_PATH}:$PATH")
+        MESSAGE(STATUS "Please do\nPATH=\"${WITH_SSL_PATH}/bin\":$PATH")
       ENDIF()
       SET(SSL_INCLUDE_DIRS ${OPENSSL_INCLUDE_DIR})
       SET(SSL_INTERNAL_INCLUDE_DIRS "")
diff --git a/extra/CMakeLists.txt b/extra/CMakeLists.txt
@@ -59,7 +59,7 @@ ADD_CUSTOM_TARGET(GenError
                   ${PROJECT_SOURCE_DIR}/sql/share/errmsg-utf8.txt)
 
 MYSQL_ADD_EXECUTABLE(my_print_defaults my_print_defaults.c)
-TARGET_LINK_LIBRARIES(my_print_defaults  mysys mysys_ssl)
+TARGET_LINK_LIBRARIES(my_print_defaults mysys mysys_ssl)
 SET_TARGET_PROPERTIES(my_print_defaults PROPERTIES LINKER_LANGUAGE CXX)
 
 MYSQL_ADD_EXECUTABLE(perror perror.c)
diff --git a/libmysql/CMakeLists.txt b/libmysql/CMakeLists.txt
@@ -185,7 +185,10 @@ ELSE()
   LIST(APPEND LIBS_TO_LINK ${ZLIB_LIBRARY})
 ENDIF()
 
-IF(WITH_SSL STREQUAL "system")
+IF(WIN32)
+  OPTION(LINK_DYNAMIC_OPENSSL "On Windows link OpenSSL dynamically" OFF)
+ENDIF()
+IF(WITH_SSL STREQUAL "system" OR LINK_DYNAMIC_OPENSSL)
   LIST(APPEND LIBS_TO_LINK ${SSL_LIBRARIES})
 ELSE()
   LIST(APPEND LIBS_TO_MERGE ${SSL_LIBRARIES})
diff --git a/mysql-test/include/allowed_ciphers.inc b/mysql-test/include/allowed_ciphers.inc
@@ -0,0 +1,10 @@
+
+# List of allowed ciphers which will be
+# replaced with "SSL_CIPHER" in the result files.
+# DHE-XXX ciphers are for OpenSSL 1.0.X while
+# ECDHE-XXX for OpenSSL 1.1.X
+# Usage: --replace_regex $ALLOWED_CIPHERS_REGEX
+#
+
+LET $ALLOWED_CIPHERS_REGEX =
+/DHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-AES128-GCM-SHA256|DHE-RSA-AES256-SHA|ECDHE-RSA-AES256-SHA|DHE-RSA-AES256-GCM-SHA384|ECDHE-RSA-AES256-GCM-SHA384/SSL_CIPHER/;
diff --git a/mysql-test/include/have_openssl.inc b/mysql-test/include/have_openssl.inc
@@ -2,3 +2,4 @@
 disable_query_log;
 show variables like "have_openssl";
 enable_query_log;
+--source include/allowed_ciphers.inc
diff --git a/mysql-test/include/have_ssl.inc b/mysql-test/include/have_ssl.inc
@@ -2,3 +2,4 @@
 disable_query_log;
 show variables like 'have_ssl';
 enable_query_log;
+--source include/allowed_ciphers.inc
diff --git a/mysql-test/include/have_ssl_communication.inc b/mysql-test/include/have_ssl_communication.inc
@@ -2,3 +2,4 @@
 disable_query_log;
 show variables like 'have_ssl';
 enable_query_log;
+--source include/allowed_ciphers.inc
diff --git a/mysql-test/r/openssl_1.result b/mysql-test/r/openssl_1.result
@@ -2,40 +2,40 @@ drop table if exists t1;
 create table t1(f1 int);
 insert into t1 values (5);
 grant select on test.* to ssl_user1@localhost require SSL;
-grant select on test.* to ssl_user2@localhost require cipher "DHE-RSA-AES256-SHA";
-grant select on test.* to ssl_user3@localhost require cipher "DHE-RSA-AES256-SHA" AND SUBJECT "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client";
-grant select on test.* to ssl_user4@localhost require cipher "DHE-RSA-AES256-SHA" AND SUBJECT "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client" ISSUER "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA";
-grant select on test.* to ssl_user5@localhost require cipher "DHE-RSA-AES256-SHA" AND SUBJECT "xxx";
+grant select on test.* to ssl_user2@localhost require cipher "SSL_CIPHER";;
+grant select on test.* to ssl_user3@localhost require cipher "SSL_CIPHER" AND SUBJECT "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client";;
+grant select on test.* to ssl_user4@localhost require cipher "SSL_CIPHER" AND SUBJECT "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client" ISSUER "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA";;
+grant select on test.* to ssl_user5@localhost require cipher "SSL_CIPHER" AND SUBJECT "xxx";;
 flush privileges;
 connect(localhost,ssl_user5,,test,MASTER_PORT,MASTER_SOCKET);
 ERROR 28000: Access denied for user 'ssl_user5'@'localhost' (using password: NO)
 SHOW STATUS LIKE 'Ssl_cipher';
 Variable_name	Value
-Ssl_cipher	DHE-RSA-AES256-SHA
+Ssl_cipher	SSL_CIPHER
 select * from t1;
 f1
 5
 delete from t1;
 ERROR 42000: DELETE command denied to user 'ssl_user1'@'localhost' for table 't1'
 SHOW STATUS LIKE 'Ssl_cipher';
 Variable_name	Value
-Ssl_cipher	DHE-RSA-AES256-SHA
+Ssl_cipher	SSL_CIPHER
 select * from t1;
 f1
 5
 delete from t1;
 ERROR 42000: DELETE command denied to user 'ssl_user2'@'localhost' for table 't1'
 SHOW STATUS LIKE 'Ssl_cipher';
 Variable_name	Value
-Ssl_cipher	DHE-RSA-AES256-SHA
+Ssl_cipher	SSL_CIPHER
 select * from t1;
 f1
 5
 delete from t1;
 ERROR 42000: DELETE command denied to user 'ssl_user3'@'localhost' for table 't1'
 SHOW STATUS LIKE 'Ssl_cipher';
 Variable_name	Value
-Ssl_cipher	DHE-RSA-AES256-SHA
+Ssl_cipher	SSL_CIPHER
 select * from t1;
 f1
 5
@@ -55,7 +55,7 @@ SHOW STATUS LIKE 'Ssl_cipher';
 Variable_name	Value
 Ssl_cipher	DHE-RSA-AES256-SHA
 Variable_name	Value
-Ssl_cipher	DHE-RSA-AES256-SHA
+Ssl_cipher	SSL_CIPHER
 End of 5.0 tests
 DROP TABLE IF EXISTS thread_status;
 DROP EVENT IF EXISTS event_status;
@@ -194,18 +194,16 @@ DROP TABLE t1;
 Variable_name	Value
 Ssl_cipher	DHE-RSA-AES256-SHA
 Variable_name	Value
-Ssl_cipher	EDH-RSA-DES-CBC3-SHA
+Ssl_cipher	DHE-RSA-AES128-SHA
 Variable_name	Value
 Ssl_cipher	AES256-SHA
-Variable_name	Value
-Ssl_cipher	RC4-SHA
 select 'is still running; no cipher request crashed the server' as result from dual;
 result
 is still running; no cipher request crashed the server
 GRANT SELECT ON test.* TO bug42158@localhost REQUIRE X509;
 FLUSH PRIVILEGES;
 SHOW STATUS LIKE 'Ssl_cipher';
 Variable_name	Value
-Ssl_cipher	DHE-RSA-AES256-SHA
+Ssl_cipher	SSL_CIPHER
 DROP USER bug42158@localhost;
 End of 5.1 tests
diff --git a/mysql-test/r/plugin_auth_sha256_tls.result b/mysql-test/r/plugin_auth_sha256_tls.result
@@ -1,6 +1,6 @@
 SHOW STATUS LIKE 'Ssl_cipher';
 Variable_name	Value
-Ssl_cipher	DHE-RSA-AES256-SHA
+Ssl_cipher	SSL_CIPHER
 CREATE USER 'kristofer' IDENTIFIED WITH 'sha256_password';
 SET GLOBAL old_passwords= 2;
 SET SESSION old_passwords= 2;
diff --git a/mysql-test/r/ssl.result b/mysql-test/r/ssl.result
@@ -1,6 +1,6 @@
 SHOW STATUS LIKE 'Ssl_cipher';
 Variable_name	Value
-Ssl_cipher	DHE-RSA-AES256-SHA
+Ssl_cipher	SSL_CIPHER
 SHOW STATUS LIKE 'Ssl_server_not_before';
 Variable_name	Value
 Ssl_server_not_before	Dec  5 04:48:40 2014 GMT
@@ -2162,7 +2162,7 @@ Warning	1052	Column 'kundentyp' in group statement is ambiguous
 drop table t1;
 SHOW STATUS LIKE 'Ssl_cipher';
 Variable_name	Value
-Ssl_cipher	DHE-RSA-AES256-SHA
+Ssl_cipher	SSL_CIPHER
 #
 # Bug#54790: Use of non-blocking mode for sockets limits performance
 #
diff --git a/mysql-test/r/ssl_8k_key.result b/mysql-test/r/ssl_8k_key.result
@@ -1,2 +1,2 @@
 Variable_name	Value
-Ssl_cipher	DHE-RSA-AES256-SHA
+Ssl_cipher	SSL_CIPHER
diff --git a/mysql-test/r/ssl_ca.result b/mysql-test/r/ssl_ca.result
@@ -5,20 +5,20 @@
 ERROR 2026 (HY000): SSL connection error: SSL_CTX_set_default_verify_paths failed
 # try to connect with correct '--ssl-ca' path : should connect
 Variable_name	Value
-Ssl_cipher	DHE-RSA-AES256-SHA
+Ssl_cipher	SSL_CIPHER
 #
 # Bug#21920678: SSL-CA DOES NOT ACCEPT ~USER TILDE HOME DIRECTORY
 #               PATH SUBSTITUTION
 #
 # try to connect with '--ssl-ca' option using tilde home directoy
 # path substitution : should connect
 Variable_name	Value
-Ssl_cipher	DHE-RSA-AES256-SHA
+Ssl_cipher	SSL_CIPHER
 # try to connect with '--ssl-key' option using tilde home directoy
 # path substitution : should connect
 Variable_name	Value
-Ssl_cipher	DHE-RSA-AES256-SHA
+Ssl_cipher	SSL_CIPHER
 # try to connect with '--ssl-cert' option using tilde home directoy
 # path substitution : should connect
 Variable_name	Value
-Ssl_cipher	DHE-RSA-AES256-SHA
+Ssl_cipher	SSL_CIPHER
diff --git a/mysql-test/r/ssl_compress.result b/mysql-test/r/ssl_compress.result
@@ -1,6 +1,6 @@
 SHOW STATUS LIKE 'Ssl_cipher';
 Variable_name	Value
-Ssl_cipher	DHE-RSA-AES256-SHA
+Ssl_cipher	SSL_CIPHER
 SHOW STATUS LIKE 'Compression';
 Variable_name	Value
 Compression	ON
@@ -2159,7 +2159,7 @@ Warning	1052	Column 'kundentyp' in group statement is ambiguous
 drop table t1;
 SHOW STATUS LIKE 'Ssl_cipher';
 Variable_name	Value
-Ssl_cipher	DHE-RSA-AES256-SHA
+Ssl_cipher	SSL_CIPHER
 SHOW STATUS LIKE 'Compression';
 Variable_name	Value
 Compression	ON
diff --git a/mysql-test/suite/auth_sec/t/cert_verify.test b/mysql-test/suite/auth_sec/t/cert_verify.test
@@ -9,8 +9,6 @@
 let $ssl_verify_fail_path = --ssl --ssl-ca=$MYSQL_TEST_DIR/std_data/ca-cert-verify.pem --ssl-key=$MYSQL_TEST_DIR/std_data/server-key-verify-fail.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/server-cert-verify-fail.pem;
 let $ssl_verify_pass_path = --ssl --ssl-ca=$MYSQL_TEST_DIR/std_data/ca-cert-verify.pem --ssl-key=$MYSQL_TEST_DIR/std_data/server-key-verify-pass.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/server-cert-verify-pass.pem;
 
-let $tls_default= TLSv1;
-
 --echo #T1: Host name (/CN=localhost/) as OU name in the server certificate, server certificate verification should fail.
 --exec echo "wait" > $MYSQLTEST_VARDIR/tmp/mysqld.1.expect
 --shutdown_server
@@ -32,7 +30,7 @@ let $tls_default= TLSv1;
 --enable_reconnect
 --source include/wait_until_connected_again.inc
 
---replace_result $tls_default TLS_VERSION
+--replace_result TLSv1 TLS_VERSION TLSv1.1 TLS_VERSION TLSv1.2 TLS_VERSION
 --exec $MYSQL --protocol=tcp --ssl-ca=$MYSQL_TEST_DIR/std_data/ca-cert-verify.pem --ssl-verify-server-cert -e "SHOW STATUS like 'Ssl_version'"
 
 --echo # restart server using restart
diff --git a/mysql-test/t/openssl_1.test b/mysql-test/t/openssl_1.test
@@ -13,11 +13,22 @@ drop table if exists t1;
 create table t1(f1 int);
 insert into t1 values (5);
 
+connect (con0,localhost,root,,,,,SSL);
+connection con0;
+let $cipher= query_get_value("SHOW STATUS like 'Ssl_cipher'", Value, 1);
+let $cipher_val= "$cipher";
+connection default;
+disconnect con0;
+
 grant select on test.* to ssl_user1@localhost require SSL;
-grant select on test.* to ssl_user2@localhost require cipher "DHE-RSA-AES256-SHA";
-grant select on test.* to ssl_user3@localhost require cipher "DHE-RSA-AES256-SHA" AND SUBJECT "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client";
-grant select on test.* to ssl_user4@localhost require cipher "DHE-RSA-AES256-SHA" AND SUBJECT "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client" ISSUER "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA";
-grant select on test.* to ssl_user5@localhost require cipher "DHE-RSA-AES256-SHA" AND SUBJECT "xxx";
+--replace_regex $ALLOWED_CIPHERS_REGEX
+--eval grant select on test.* to ssl_user2@localhost require cipher $cipher_val;
+--replace_regex $ALLOWED_CIPHERS_REGEX
+--eval grant select on test.* to ssl_user3@localhost require cipher $cipher_val AND SUBJECT "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client";
+--replace_regex $ALLOWED_CIPHERS_REGEX
+--eval grant select on test.* to ssl_user4@localhost require cipher $cipher_val AND SUBJECT "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=Client" ISSUER "/C=SE/ST=Stockholm/L=Stockholm/O=Oracle/OU=MySQL/CN=CA";
+--replace_regex $ALLOWED_CIPHERS_REGEX
+--eval grant select on test.* to ssl_user5@localhost require cipher $cipher_val AND SUBJECT "xxx";
 flush privileges;
 
 connect (con1,localhost,ssl_user1,,,,,SSL);
@@ -30,27 +41,31 @@ connect (con5,localhost,ssl_user5,,,,,SSL);
 
 connection con1;
 # Check ssl turned on
+--replace_regex $ALLOWED_CIPHERS_REGEX
 SHOW STATUS LIKE 'Ssl_cipher';
 select * from t1;
 --error ER_TABLEACCESS_DENIED_ERROR
 delete from t1;
 
 connection con2;
 # Check ssl turned on
+--replace_regex $ALLOWED_CIPHERS_REGEX
 SHOW STATUS LIKE 'Ssl_cipher';
 select * from t1;
 --error ER_TABLEACCESS_DENIED_ERROR
 delete from t1;
 
 connection con3;
 # Check ssl turned on
+--replace_regex $ALLOWED_CIPHERS_REGEX
 SHOW STATUS LIKE 'Ssl_cipher';
 select * from t1;
 --error ER_TABLEACCESS_DENIED_ERROR
 delete from t1;
 
 connection con4;
 # Check ssl turned on
+--replace_regex $ALLOWED_CIPHERS_REGEX
 SHOW STATUS LIKE 'Ssl_cipher';
 select * from t1;
 --error ER_TABLEACCESS_DENIED_ERROR
@@ -124,6 +139,7 @@ drop table t1;
 # verification of servers certificate by setting both ca certificate
 # and ca path to NULL
 #
+--replace_regex $ALLOWED_CIPHERS_REGEX
 --exec $MYSQL --ssl --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem -e "SHOW STATUS LIKE 'ssl_Cipher'" 2>&1
 --echo End of 5.0 tests
 
@@ -210,10 +226,9 @@ DROP TABLE t1;
 #           YaSSL to crash the server.
 #
 
---exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl_cipher';" --ssl-cipher=DHE-RSA-AES256-SHA
---exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl_cipher';" --ssl-cipher=EDH-RSA-DES-CBC3-SHA
---exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl_cipher';" --ssl-cipher=AES256-SHA
---exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl_cipher';" --ssl-cipher=RC4-SHA
+--exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl_cipher';" --ssl-mode=REQUIRED --ssl-cipher=DHE-RSA-AES256-SHA
+--exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl_cipher';" --ssl-mode=REQUIRED --ssl-cipher=DHE-RSA-AES128-SHA
+--exec $MYSQL --host=localhost -e "SHOW STATUS LIKE 'Ssl_cipher';" --ssl-mode=REQUIRED --ssl-cipher=AES256-SHA
 --disable_query_log
 --disable_result_log
 
@@ -249,6 +264,7 @@ select 'is still running; no cipher request crashed the server' as result from d
 GRANT SELECT ON test.* TO bug42158@localhost REQUIRE X509;
 FLUSH PRIVILEGES;
 connect(con1,localhost,bug42158,,,,,SSL);
+--replace_regex $ALLOWED_CIPHERS_REGEX
 SHOW STATUS LIKE 'Ssl_cipher';
 disconnect con1;
 connection default;
diff --git a/mysql-test/t/plugin_auth_sha256_tls.test b/mysql-test/t/plugin_auth_sha256_tls.test
@@ -2,6 +2,7 @@
 --source include/have_ssl.inc
 
 connect (ssl_con,localhost,root,,,,,SSL);
+--replace_regex $ALLOWED_CIPHERS_REGEX
 SHOW STATUS LIKE 'Ssl_cipher';
 
 CREATE USER 'kristofer' IDENTIFIED WITH 'sha256_password';
diff --git a/mysql-test/t/ssl-sha512.test b/mysql-test/t/ssl-sha512.test
@@ -4,7 +4,6 @@ CREATE USER u1@localhost IDENTIFIED BY 'secret';
 GRANT SELECT ON test.* TO u1@localhost REQUIRE SSL;
  
 --replace_result $MYSQL_TEST_DIR MYSQL_TEST_DIR
---exec $MYSQL -uu1 -psecret -h127.0.0.1 --ssl-ca=$MYSQL_TEST_DIR/std_data/ca-sha512.pem --ssl-cipher=EDH-RSA-DES-CBC3-SHA test -e "SHOW VARIABLES like '%ssl%';"
+--exec $MYSQL -uu1 -psecret -h127.0.0.1 --ssl-ca=$MYSQL_TEST_DIR/std_data/ca-sha512.pem --ssl-cipher=DHE-RSA-AES256-SHA test -e "SHOW VARIABLES like '%ssl%';"
 
 DROP USER u1@localhost;
-
diff --git a/mysql-test/t/ssl.test b/mysql-test/t/ssl.test
@@ -11,6 +11,7 @@
 connect (ssl_con,localhost,root,,,,,SSL);
 
 # Check ssl turned on
+--replace_regex $ALLOWED_CIPHERS_REGEX
 SHOW STATUS LIKE 'Ssl_cipher';
 
 # Check ssl expiration
@@ -21,6 +22,7 @@ SHOW STATUS LIKE 'Ssl_server_not_after';
 -- source include/common-tests.inc
 
 # Check ssl turned on
+--replace_regex $ALLOWED_CIPHERS_REGEX
 SHOW STATUS LIKE 'Ssl_cipher';
 
 connection default;
diff --git a/mysql-test/t/ssl_8k_key.test b/mysql-test/t/ssl_8k_key.test
@@ -4,6 +4,7 @@
 #
 # Bug#29784 YaSSL assertion failure when reading 8k key.
 #
+--replace_regex $ALLOWED_CIPHERS_REGEX
 --exec $MYSQL --ssl --ssl-key=$MYSQL_TEST_DIR/std_data/client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/client-cert.pem -e "SHOW STATUS LIKE 'ssl_Cipher'" 2>&1
 
 ##  This test file is for testing encrypted communication only, not other
diff --git a/mysql-test/t/ssl_ca.test b/mysql-test/t/ssl_ca.test
@@ -10,6 +10,7 @@
 --exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/wrong-crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem test -e "SHOW STATUS LIKE 'Ssl_cipher'" 2>&1
 
 --echo # try to connect with correct '--ssl-ca' path : should connect
+--replace_regex $ALLOWED_CIPHERS_REGEX
 --exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem test -e "SHOW STATUS LIKE 'Ssl_cipher'"
 
 --echo #
@@ -21,12 +22,15 @@
 
 --echo # try to connect with '--ssl-ca' option using tilde home directoy
 --echo # path substitution : should connect
+--replace_regex $ALLOWED_CIPHERS_REGEX
 --exec $MYSQL --ssl-ca=$mysql_test_dir_path/std_data/crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem test -e "SHOW STATUS LIKE 'Ssl_cipher'"
 
 --echo # try to connect with '--ssl-key' option using tilde home directoy
 --echo # path substitution : should connect
+--replace_regex $ALLOWED_CIPHERS_REGEX
 --exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/crl-ca-cert.pem --ssl-key=$mysql_test_dir_path/std_data/crl-client-key.pem --ssl-cert=$MYSQL_TEST_DIR/std_data/crl-client-cert.pem test -e "SHOW STATUS LIKE 'Ssl_cipher'"
 
 --echo # try to connect with '--ssl-cert' option using tilde home directoy
 --echo # path substitution : should connect
+--replace_regex $ALLOWED_CIPHERS_REGEX
 --exec $MYSQL --ssl-ca=$MYSQL_TEST_DIR/std_data/crl-ca-cert.pem --ssl-key=$MYSQL_TEST_DIR/std_data/crl-client-key.pem --ssl-cert=$mysql_test_dir_path/std_data/crl-client-cert.pem test -e "SHOW STATUS LIKE 'Ssl_cipher'"
diff --git a/mysql-test/t/ssl_compress.test b/mysql-test/t/ssl_compress.test
diff --git a/mysql-test/t/ssl_verify_identity.test b/mysql-test/t/ssl_verify_identity.test
diff --git a/mysys_ssl/CMakeLists.txt b/mysys_ssl/CMakeLists.txt
diff --git a/mysys_ssl/crypt_genhash_impl.cc b/mysys_ssl/crypt_genhash_impl.cc
diff --git a/mysys_ssl/my_aes_openssl.cc b/mysys_ssl/my_aes_openssl.cc
diff --git a/sql/mysqld.cc b/sql/mysqld.cc
diff --git a/sql/rpl_slave.cc b/sql/rpl_slave.cc
diff --git a/vio/vio.c b/vio/vio.c
diff --git a/vio/viossl.c b/vio/viossl.c
diff --git a/vio/viosslfactories.c b/vio/viosslfactories.c
