PHP TCP connection to EPP API using SSL certificate authentication

Question

I have tried this upwards and backwards without any success. The national domain registry department has decided to change their entire system to EPP. Their documentation is very poor but to summarize:

Connection via TCP: epptest.ficora.fi port 700
To whitelist for firewall, add IP address and SSL certificate to user account on dashboard (done that)

The dashboard is a total mess. I cannot upload the same certificate to different users, I can't remove users etc. Anyhow, you are supposed to connect to that address and verify yourself using the same SSL certificate in the request (atleast that's what I've understood) but I cannot get it to work. All my requests return:

Error 7: "Failed to connect to epptest.ficora.fi port 700: Timed out"

I've created a login XML based on the documentation which I send out in the POST request.

    ini_set('max_execution_time', 300);
    set_time_limit(0);

    $curl = curl_init();

    curl_setopt($curl, CURLOPT_URL, 'epptest.ficora.fi');
    curl_setopt($curl, CURLOPT_PORT, 700);
    curl_setopt($curl, CURLOPT_POST, 1);
    curl_setopt($curl, CURLOPT_POSTFIELDS, $content);
    curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, 0);
    curl_setopt($curl, CURLOPT_CONNECTTIMEOUT ,0);
    curl_setopt($curl, CURLOPT_TIMEOUT, 400);
    curl_setopt($curl, CURLOPT_SSLCERT, __DIR__ . '/certificate.crt');

    $output = curl_exec($curl);
    echo 'Error ' . curl_errno($curl) . ': "' . curl_error($curl) .'"';
    curl_close($curl);

The certificate file can be found, I did a file_get_contents() test and reads OK. This is a localhost test on a Windows computer.

Testing the same code on my own (live) server I get:

Error 56: "Recv failure: Connection reset by peer"

I don't know if this sounds stupid or not but does the request have to originate from a server, from an address, where the SSL certificate is in use?

I am at a complete loss with this as to why it doesn't work. Help, anyone?

EDIT

Here's the cURL verbose information:

* About to connect() to epptest.ficora.fi port 700 (#0)
* Trying <ip_address>
* connected
* Connected to epptest.ficora.fi (<ip address>) port 700 (#0)
> POST / HTTP/1.1
Host: epptest.ficora.fi:700
Accept: */*
Content-type: text/xml
Content-length: 146

* upload completely sent off: 146 out of 146 bytes
* additional stuff not fine transfer.c:1037: 0 0
* Recv failure: Connection reset by peer
* Closing connection #0

score 2 · Accepted Answer · edited May 23 '17 at 12:14

The answer in the end came to me through another Stackoverflow post. I actually didn't have the private key in the certificate so what I had to do was create a new .pem file (just plain text in any editor) and paste the private key and certificate in it like so:

-----BEGIN RSA PRIVATE KEY-----

-----END RSA PRIVATE KEY-----

-----BEGIN CERTIFICATE----

-----END CERTIFICATE-----

The certificate is supposed to have the key in it. All I had was them separate. No one actually pointed this out.

HOWEVER! I was not able to make this work in cURL. The response I got was through a PHP-EPP library that uses stream_socket_client() function.

You should be aware that the EPP protocol does not use HTTP, so probably CURL won't help much. It works using a custom protocol directly over TCP port 700. (Sorry, I could have mentioned this earlier.) — Kennu, Aug 31 '16 at 18:46

Kennu · Answer 2 · 2016-08-31T18:48:56.143

1

I've seen two kinds of errors from epptest.ficora fi:

Connection timeout indicates the IP address is not allowed to connect.
Connection reset by peer indicates the certificate is invalid.

This weekend all my connections failed with Connection reset by peer. Today (29.8.2016) it started working again, so this was probably a temporary issue. So far I have seen successful authentication with CAcert server certificates and Comodo FreeSSL certificates.

However, an IP address that I enabled two days ago is still blocked. It's possible that their automatic firewall updating every 8 hours is not working as documented and that you'll need to contact Ficora support (fi-domain-tech@ficora.fi) to open the IP.

Also, I don't believe curl supports EPP, so it's probably not useful in this case. (EPP is a custom protocol used over TCP port 700. It's not based on HTTP.)

edited Aug 31 '16 at 18:48

answered Aug 29 '16 at 08:57

Kennu

1,093
9
13

I've already contacted them and they are complete morons. I have actually been instructed to use a 'private certificate' to verify myself in CRT or PRM format, a term I am completely unfamiliar with until I confirmed that they meant PRIVATE KEY. Unfortunately, no EPP connection library I've checked uses private key, but 'local_cert' which can only refer to the certificate file and I don't understand how you can verify yourself with it. Do you have any input on as to exactly WHAT files you are supposed to send? I've tried CURLOPT_SSLKEY with no luck to send the private key. – Rcls Aug 30 '16 at 17:27
Oh and in their messages they said they had a configuration error throughout the entire weekend so your problem must be that. I however cannot verify myself in any way. If you have some input as to the files I'm supposed to pass, that'd be great! – Rcls Aug 30 '16 at 17:30

PHP TCP connection to EPP API using SSL certificate authentication

2 Answers2

Linked