This question already has an answer here:
Look at this cipher:
ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD
It uses AES-GCM for encryption and data origin authentication (according to RFC-5288), so no separate MAC is required. That is why OpenSSL reports it uses AEAD (Authenticated Encryption) for message authentication.
My question is: what does SHA256 mean here? Why do I need hash function if my MAC is already implemented as part of ENC?