2

I know from this thread what attacks are possible when CURLOPT_SSL_VERIFYHOST is disabled. I'd like to know what attacks are possible when VERIFYPEER, not _VERIFYHOST, is disabled. Is it an acceptable risk for payments with credit cards?

(the reason I ask is because my code works only with _VERIFYPEER disabled, though nobody seems to know why)

Community
  • 1
  • 1
drake035
  • 3,955
  • 41
  • 119
  • 229
  • 2
    If you read my answer you're linking to, it says "*To compare it to a real-life scenario, VERIFYPEER is like checking that the form of ID is one that you recognise (i.e. passport from a country you trust, staff card from a company you know, ...). VERIFYHOST is like checking the actual name on the card matches who you wanted to talk to.*". Sorry if it's not worded clearly enough, but if you don't even check whether you trust the cert you get, it should be quite obvious that you can't rely on what that cert says at all. – Bruno Feb 17 '13 at 16:41

1 Answers1

5

If you disable CURLOPT_SSL_VERIFYPEER, curl will not check that the certificate is actually signed by a trusted authority. This is very dangerous! In a MITM situation, without VERIFYPEER, the attacker can simply substitute his own "self-signed" certificate for the real certificate, and as long as the host name matches (which he can always do, since he's making the certificate), your app will accept it.

Your code is likely failing because you don't have the CA certificate store set up, and the server you are talking to is signed by a CA not in curl's default repository. Consider using CURLOPT_CAINFO or CURLOPT_CAPATH to specify the certificates to verify against, and ensure that the certificates you are using for verification are accessible and match the target server's certificates.

nneonneo
  • 171,345
  • 36
  • 312
  • 383
  • 1
    It did work, thanks! Actually I did have CURLOPT_CAINFO => dirname(__FILE__) . '/cacert.pem' in my code, only the cacert.pem file did not exist in my folder. So I downloaded it at http://curl.haxx.se/docs/caextract.html and copied it in the folder, now it works! – drake035 Feb 20 '13 at 19:01