Can't connect to HTTPS site using cURL. Returns 0 length content instead. What can I do?

Question

I have a site that connects using cURL (latest version) to a secure gateway for payment.

The problem is cURL always returns 0 length content. I get headers only. And only when I set cURL to return headers. I have the following flags in place.

curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_ANY);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_URL, $gatewayURI);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_POST, 1);

The header returned is

HTTP/1.1 100 Continue

HTTP/1.1 200 OK
Date: Tue, 25 Nov 2008 01:08:34 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 0
Content-Type: text/html
Set-Cookie: ASPSESSIONIDxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx; path=/
Cache-control: private

I have also tried cURL'ing different sites and they return content fine. I think the problem might have something to do with the https connection.

I have spoken with the company and they are unhelpful.

Has anyone else experienced this error and know a work around? Should I ditch cURL and try and use fsockopen() ?

Thank you. :)

SchizoDuckie · Answer 1 · 2017-10-23T12:33:19.560

100

I had the same problem today. Curl comes with an outdated file to authenticate HTTPS certificates from.

get the new one from:

http://curl.haxx.se/ca/cacert.pem

save it into some dir on your site

and add

curl_setopt ($curl_ch, CURLOPT_CAINFO, dirname(__FILE__)."/cacert.pem");

To every request :-)

IGNORE any dumbass comments about disabling CURLOPT_VERIFYPEER and CURLOPT_VERIFYHOST!! That leaves your code vulnerable to man in the middle attacks!

December 2016 edit:

Solve this properly by using Jasen's method mentioned below.

add curl.cainfo=/etc/ssl/certs/ca-certificates.crt to you php.ini

October 2017 edit:

There is now a composer package that helps you manage the ca certificates, so that you're not vulnerable if your cacert.pem becomes outdated due to revoking certificates.

https://github.com/paragonie/certainty -> composer require paragonie/certainty:dev-master

edited Oct 23 '17 at 12:33

answered Nov 25 '08 at 08:52

SchizoDuckie

9,353
6
33
40

1

This sounded promising but it didn't work :( Do you have any other ideas? – alex Nov 26 '08 at 02:39
2

Disable your own veryfipeer and verifyhost calls. You have them in the examplecode in your post. They need to be enabled! – SchizoDuckie Nov 26 '08 at 10:03
I tried that... did your server you cURL'd to also return only headers with content-length: 0 ? This is driving me insane.... – alex Nov 26 '08 at 23:22
6

5 years later, still relevant. This fixed it for me! (Running WAMPServer 2.4 on Windows 7 32-bit if that helps...) – chrisfrancis27 Aug 22 '13 at 22:27
4

Worked for me in 2014! – ScottyB Jan 03 '14 at 19:02
1

Still going strong in September 2015 -- nearly 7 years later – gillytech Sep 18 '15 at 03:37
Should be CURLOPT_CAPATH not? – Phillip Kamikaze Nov 22 '15 at 04:03
1

I was able to use the system default certs by adding `curl.cainfo=/etc/ssl/certs/ca-certificates.crt` to my php.ini - this saves manual downloads and editing much php code. – Jasen Dec 07 '16 at 23:27
1

*＋1* for *"IGNORE any dumbass comments about disabling CURLOPT_VERIFYPEER and CURLOPT_VERIFYHOST!!"* – jww Nov 28 '19 at 16:40

score 35 · Accepted Answer · answered Dec 03 '08 at 00:47

35

You should also try checking the error messages in curl_error(). You might need to do this once after each curl_* function.

http://www.php.net/curl_error

answered Dec 03 '08 at 00:47

too much php

88,666
34
128
138

1

awesome. thank you. this revealed my problem. i solved it using SchizoDuckie's solution. – Zack Burt Sep 20 '10 at 07:19

mixdev · Answer 3 · 2012-12-06T12:45:26.427

29

Note: This is strictly not production use. If you want to quickly debug, this may be useful. Otherwise, please use @SchizoDuckie's answer above.

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);     
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);

Just add them. It works.

edited Dec 06 '12 at 12:45

answered Jul 21 '10 at 22:43

mixdev

2,724
2
30
25

5

This worked for me. I don't understand the downvotes @mixdev got. – Edi Budimilic Aug 11 '11 at 15:55
It still wouldn't work for me until I added `curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_ANY);` Now it works fine. – n8bar Mar 27 '17 at 16:00

score 6 · Answer 4 · answered Oct 19 '12 at 20:12

6

Just had a very similar problem and solved it by adding

curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);

Apparently the site I'm fetching redirects to another location and php-curl doesn't follow redirects by default.

answered Oct 19 '12 at 20:12

Cobra_Fast

15,671
8
57
102

score 4 · Answer 5 · answered Jun 12 '13 at 00:13

4

I had a situation where this helped: (PHP 5.4.16 on Windows)

curl_setopt($ch, CURLOPT_SSLVERSION, 3);

answered Jun 12 '13 at 00:13

user203319

51
2

1

curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); curl_setopt($ch, CURLOPT_SSLVERSION, 3); it work like a charm, thank you – Nam Nguyen Jun 27 '14 at 02:48

score 3 · Answer 6 · answered Nov 25 '08 at 02:48

3

Whenever I'm testing something with PHP/Curl, I try it from the command line first, figure out what works, and then port my options to PHP.

answered Nov 25 '08 at 02:48

Issac Kelly

6,309
6
43
50

score 2 · Answer 7 · answered Feb 05 '10 at 11:24

2

Sometimes you have to upgrade your Curl certificates to latest version not to have errors with https.

answered Feb 05 '10 at 11:24

Elzo Valugi

27,240
15
95
114

score 1 · Answer 8 · edited Sep 18 '16 at 17:57

I used file_get_contents using stream_create_context and it works fine:

$postdataStr = http_build_query($postdataArr);

$context_options = array (
        'http' => array (    <blink> // this will allways be http!!!</blink>
            'method' => 'POST',
            'header'=> "Content-type: application/x-www-form-urlencoded\r\n"
                . "Content-Length: " . strlen($postdataArr) . "\r\n"
                . "Cookie: " . $cookies."\r\n"
            'content' => $postdataStr
            )
        );

$context = stream_context_create($context_options);
$HTTPSReq = file_get_contents('https://www.example.com/', false, $context);

score 0 · Answer 9 · answered Oct 06 '09 at 17:32

I discovered this error on a recent application project. I was writing to run from the command line or the browser window, so I was using server detection to get the relative URL of the document I was asking for. The trouble was, the site is https, and each time I attempted to access http://(same server), cURL helpfully changed it to https.

This works fine from the browser, but from the command-line, I'd then get an SSL error even with both verify's set to false. What I had to do was,

1) Check $_SERVER['HTTP_HOST']. If present, use ($_SERVER['HTTPS'] ? "https://" : "http://").$_SERVER['HTTP_HOST']

2) Check $_SERVER['COMPUTERNAME'], and if it matched the production server, provide the https URL. ("https://(servername)")

3) If neither condition passed, it means I'm running command-line on a different server, and use "http://localhost".

Now, this worked, but it's a hack. Also, I never did figure out why on one server (https) cURL changed my URL, while on the other (also https) it left my URL alone.

Weird.

score 0 · Answer 10 · answered Nov 25 '08 at 03:36

0

there might be a problem at your web hosting company from where you are testing the secure communication for gateway, that they might not allow you to do that.

also there might be a username, password that must be provided before connecting to remote host.

or your IP might need to be in the list of approved IP for the remote server for communication to initiate.

answered Nov 25 '08 at 03:36

Web hosting company denies any problem Username/password is not necessary There is no white list on the other server Thank you for your suggestions :) – alex Nov 25 '08 at 05:51

Heitor · Answer 11 · 2017-10-06T09:04:30.803

The best way to use https and avoid security issues is to use Firefox (or another tool) and download the certificate to your server. This webpage helped me a lot, and these were the steps that worked for me:

1) Open in Firefox the URL you're gonna use with CURL

2) On the address bar click on the padlock > more information (FF versions can have different menus, just find it). Click the View certificate button > Details tab.

3) Highlight the "right" certificate in Certificate hierarchy. In my case it was the second of three, called "cPanel, Inc. Certification Authority". I just discovered the right one by "trial and error" method.

4) Click the Export button. In my case the one who worked was the file type "PEM with chains" (again by trial and error method).

5) Then in your PHP script add:

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);    
curl_setopt($ch, CURLOPT_CAINFO, [PATH_TO_CRT_FILE]);

In addition I'd say that we must pay attention on the fact that these steps will probably need to be redone once a year or whenever the URL certificate is replaced or renewed.

score -1 · Answer 12 · answered Nov 25 '08 at 02:33

-1

You are using POST method, but are you providing an array of data? E.g.

curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);

answered Nov 25 '08 at 02:33

too much php

88,666
34
128
138

$data would be simply the string of an XML file... the company says this is how it should be sent. – alex Nov 25 '08 at 05:50

Can't connect to HTTPS site using cURL. Returns 0 length content instead. What can I do?

12 Answers12

Linked