7

I have been developing a site locally that authenticates against a centrailzed signon. One of the steps is requiring me to make a curl request to an https resource to get an access token.

Part of the curl config is:

    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);                                         
    //curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);

As you can see I commented out the CURLOPT_SSL_VERIFYHOST option. I have read on php.net and on various blogs/stackoverflow (Security consequences of disabling CURLOPT_SSL_VERIFYHOST (libcurl/openssl)) posts WHAT these options mean.

On my development machine CURLOPT_SSL_VERIFYHOST 2 has been working fine. I am just using the vanilla php install provided in ubuntu 12.04 php5 package, and php5-curl.

On production (rackspace cloudsites) the CURLOPT_SSL_VERIFYHOST 2 is not working, which is why I changed it to false to verify this was the issue. Seeing as i didn't explicitly do anything to enable this on my localhost I do not know what directives/config options controls this.

What I mean by it is "not working" is that on production the curl call is returning an http_code of 0 when the VERIFYHOST is set to 2. When I set it to FALSE it is returning a status code of 200

My question is:

How can i enable SSL_VERIFYHOST on a linux box?

Any help would be greatly appreciated. Thank you.

Community
  • 1
  • 1
dm03514
  • 54,664
  • 18
  • 108
  • 145
  • 2
    curl's default is `2` for this setting: http://php.net/manual/en/function.curl-setopt.php – Marc B Mar 21 '13 at 15:51

1 Answers1

7

For '2' you have to ensure the common name in the SSL certificate matches the hostname being utilized. This is the default and should be straight-forward as long as your SSL certificate is appropriately created for the hostname (common name) you're using it on.

From the PHP curl_setopt manual:

1 to check the existence of a common name in the SSL peer certificate. 2 to check the existence of a common name and also verify that it matches the hostname provided. In production environments the value of this option should be kept at 2 (default value).

Manual Entry for curl_setopt

Mark Stanislav
  • 979
  • 4
  • 11