Curl request is failing on the SSL?

Question

I have this code

    if(ereg("^(https)",$url))
        curl_setopt($curl,CURLOPT_SSL_VERIFYPEER,false);
    // execute, and log the result to curl_put.log
    $result = curl_exec($curl);


    $error = curl_error($curl);

The error specified is

SSL read: error:00000000:lib(0):func(0):reason(0), errno 104

Any ideas on the cause

is this not the same question? http://stackoverflow.com/questions/3875674/my-password-curl-is-failing-sometimes — Phill Pafford, Oct 06 '10 at 20:26
Please note that [disabling VERIFYPEER or VERIFYHOST makes the connection vulnerable to MITM attacks](http://stackoverflow.com/a/13742121/372643). — Bruno, Nov 21 '14 at 11:22

score 32 · Answer 1 · edited May 23 '17 at 12:26

I encountered a similar cryptic error while working with a third-party library. I tried the CURLOPT_SSL_VERIFY[PEER|HOST] but it made no difference. My error message was similar:

SSL read: error:00000000:lib(0):func(0):reason(0), errno 54

So I visited http://curl.haxx.se/libcurl/c/libcurl-errors.html, looking for the error code 54.

CURLE_SSL_ENGINE_SETFAILED (54) Failed setting the selected SSL crypto engine as default!

This was wrong though - I was making other HTTPS requests using curl in other parts of the application. So I kept digging and found this question, R & RCurl: Error 54 in libcurl, which had this gem:

The output you see is from lib/ssluse.c in libcurl's source code and the "errno" mentioned there is not the libcurl error code but the actual errno variable at that time.

So, don't let the output of curl_error() mislead you. Instead, use curl_errno() to obtain the correct error code, which in this case was actually 56, CURLE_RECV_ERROR. Had the wrong host name...

I got errno 104, instead it was also really 56, thanks! – Graftak Mar 02 '17 at 13:42 — Graftak, Mar 02 '17 at 13:42

Sarfraz · Accepted Answer · 2010-10-06T20:32:41.463

13

With SSL, make sure that you have openssl extension turned on from php.ini.

edited Oct 06 '10 at 20:32

answered Oct 06 '10 at 20:26

Sarfraz

377,238
77
533
578

How do I turn that on? – Jake Sylvestre Feb 24 '16 at 00:32
in the PHP.ini file if you are using WAMPP or XAMPP , but still, after enabling it, i am having the same error code – Zame Aug 09 '16 at 12:59

score 1 · Answer 3 · answered Sep 23 '16 at 14:58

I've had the same problem. It turned out, that the ssl on the target system had a bad configuration.

After checking the php curl module, the GuzzleHttp version, the openssl version I called the link in the browser and it worked. But with curl --tlsv1 -kv https://www.example.com on the console there was still an error.

So I checked the ssl configuration at https://www.ssllabs.com/ssltest/ It was rated with B. And there where some Online Certificate Status Protocol (OCSP) errors I haven't seen before. Finally I changed my configuration on the target system to the suggestions at https://cipherli.st/ restarted the webserver and everything worked. The new rating at ssllabs is now A+.

My nginx configuration (Ubuntu 14.04, nginx 1.4.6-1ubuntu3.5):

ssl     on;
ssl_certificate /etc/ssl/certs/1_www.example.com_bundle.crt;
ssl_certificate_key     /etc/ssl/private/www.example.com.key;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
ssl_session_cache shared:SSL:10m;
#ssl_session_tickets off; # Requires nginx >= 1.5.9
ssl_stapling on; # Requires nginx >= 1.3.7
ssl_stapling_verify off; # Requires nginx => 1.3.7
ssl_dhparam /etc/ssl/private/dhparams.pem;
ssl_trusted_certificate /etc/ssl/startssl.ca.pem;
resolver 8.8.8.8 valid=300s;
resolver_timeout 5s;
add_header Strict-Transport-Security "max-age=63072000; www.example.com; preload";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;

In my case I also needed to limit the `ssl_protocols` to `TLSv1.2` as v1 and v1.1 conflicted with the rest of my environment. — shawncampbell, Jul 12 '18 at 23:34

score 0 · Answer 4 · answered Aug 09 '13 at 09:56

I had the same error printed by the function curl_error but this is not necessarily related to SSL. It is better to print the precise error number with the function curl_errno and you can diagnose better from there. In my case it returned me a 52 error code and I could debug from there, in fact the other server was not sending any data.

score 0 · Answer 5 · answered Oct 07 '10 at 01:02

0

I think you mean to use CURLOPT_SSL_VERIFYHOST, not CURLOPT_SSL_VERIFYPEER

answered Oct 07 '10 at 01:02

Eli

5,500
1
29
27

score 0 · Answer 6 · answered Dec 09 '19 at 17:00

0

It means the destination server require an SSL communication.

You should generate an SSL certificate for your sending server from wich you run the CURL request

Let's Encrypt is the first free and open CA

Everything is described here sslforfree.com

answered Dec 09 '19 at 17:00

Ahmed Mihoub

547
4
6

score 0 · Answer 7 · edited Feb 28 '22 at 11:41

0

I solved this curl error: "SSL read: error:00000000:lib(0):func(0):reason(0), errno 104" by removing extra space from my url query parameter value (comma separated values).

For example:

https://example.com?a=123,456,SPACE_ADDED_BY_MISTAKE789

to

https://example.com?a=123,456,789

edited Feb 28 '22 at 11:41

Dharman

30,962
25
85
135

answered Feb 28 '22 at 11:36

Shivam Dhuria

1

score 0 · Answer 8 · edited Jan 31 '12 at 03:08

0

add this:

curl_setopt( $curl, CURLOPT_SSL_VERIFYHOST, 0);

I had the same error and worked fine for me.

edited Jan 31 '12 at 03:08

wim

338,267
99
616
750

answered Nov 04 '11 at 20:53

jacktrade

3,125
2
36
50

4

why use HTTPS at all if verify is off? – Marius Balčytis Feb 21 '14 at 08:36
5

if you trust the channel, you can disregard the flag verify host, the encryption works, but you dont need to check the cert – jacktrade Feb 21 '14 at 09:18
1

This just makes the connection vulnerable to MITM attacks (see [this](http://stackoverflow.com/a/13742121/372643)). – Bruno Nov 21 '14 at 11:21
no if you are using this curl to get data from your own network, read unencrypted data do not implies attack, sometimes you dont need to encrypt this data. – jacktrade Feb 05 '15 at 15:01

Curl request is failing on the SSL?

8 Answers8

Linked