0

I've this Curl request :

curl.exe -k --proxy-ntlm --proxy-user : --proxy http://proxyurl:80 -E C:\temp\certificat.pem:certifPassword -H depth:1 -X PROPFIND https://www.url.fr/to/webdav/number/folder/ > retour.xml

I've to translate it in php script. So I did this :

$ch = curl_init();

$urlPropfind = "https://www.url.fr/to/webdav/number/folder/";
$certifPropfind = __DIR__."/certificats/certificat.pem";
$passwordPropfind = "certifPassword";
$header = "depth:1";

//Proxy config
$proxyAdresse = "http://proxyUrl";
$proxyIp = "192.168.0.1"; //I change IP for security
$proxyPort = 80;
$proxyIdentification = "proxyUser:proxyPassword";

curl_setopt($ch, CURLOPT_PROXY, $proxyIp);
curl_setopt($ch, CURLOPT_PROXYPORT, $proxyPort);
curl_setopt($ch, CURLOPT_PROXYTYPE, 'HTTP');
curl_setopt($ch, CURLOPT_PROXYUSERPWD, $proxyIdentification);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($ch, CURLOPT_SSLCERT, $certifPropfind);
curl_setopt($ch, CURLOPT_SSLCERTPASSWD, $passwordPropfind);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_URL, $urlPropfind);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "PROPFIND");
curl_setopt($ch, CURLOPT_HTTPHEADER, array($header));

$output = curl_exec($ch);

var_dump($output);

var_dump(curl_getinfo($ch));
curl_close($ch);

But my curl return FALSE so I don't understand what did I do wrong ?

The error:

HTTP/1.1 200 Connection established < * Proxy replied OK to CONNECT request * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * NSS: client certificate not found: certServeurTM.pem * NSS error -12227 (SSL_ERROR_HANDSHAKE_FAILURE_ALERT) * SSL peer was unable to negotiate an acceptable set of security parameters. * Closing connection 2

And

  • Initializing NSS with certpath: sql:/etc/pki/nssdb
  • CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none
  • unable to load client key: -8178 (SEC_ERROR_BAD_KEY)
  • NSS error -8178 (SEC_ERROR_BAD_KEY)
  • Peer's public key is invalid.
  • Closing connection 0

EDIT

I converted this to PHP & here my :

curl_setopt($ch, CURLOPT_URL, $urlPropfind);
  curl_setopt($ch, CURLOPT_NOPROGRESS, true);
  curl_setopt($ch, CURLOPT_PROXY, $proxyAdresse);
  curl_setopt($ch, CURLOPT_PROXYUSERPWD, $proxyIdentification);
  curl_setopt($ch, CURLOPT_PROXYAUTH, CURLAUTH_NTLM);
  curl_setopt($ch, CURLOPT_USERAGENT, "curl/7.29.0");
  curl_setopt($ch, CURLOPT_HTTPHEADER, array($header));
  curl_setopt($ch, CURLOPT_MAXREDIRS, 50);
  curl_setopt($ch, CURLOPT_KEYPASSWD, "/var/www/html/myapplication/certificats/certServeurTM.pem:toulouse31");
  curl_setopt($ch, CURLOPT_SSLCERT, "certServeurTM.pem");
  curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
  curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
  curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "PROPFIND");
  curl_setopt( $ch, CURLOPT_VERBOSE, true );
  curl_setopt( $ch, CURLOPT_STDERR, fopen('php://output', 'w') );

& message I get (only the end of message. All is good until certificat):

HTTP/1.1 200 Connection established < * Proxy replied OK to CONNECT request * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * NSS: client certificate not found: certServeurTM.pem * NSS error -12227 (SSL_ERROR_HANDSHAKE_FAILURE_ALERT) * SSL peer was unable to negotiate an acceptable set of security parameters. * Closing connection 2

I added 

curl_setopt($ch, CURLOPT_CAPATH, "/var/www/html/myapplication/certificats");

& I see the following message

failed to load '/var/www/html/myapplication/certificats/certServeurTM.pem' from CURLOPT_CAPATH

LynxWeb
  • 69
  • 1
  • 9

3 Answers3

0

Add the following code to your script, after the last curl_setopt, and see what output you get:

curl_setopt( $ch, CURLOPT_VERBOSE, true );
curl_setopt( $ch, CURLOPT_STDERR, fopen('php://output', 'w') );

This will give you a clue at what the issue is. If you are unable to resolve the issue yourself, please update your question with the output of the new code.

Niraj Shah
  • 15,087
  • 3
  • 41
  • 60
  • Thanks for reply. With curl_error($ch) I get the following message : Received HTTP code 407 from proxy after CONNECT – LynxWeb Mar 13 '17 at 14:33
  • That would have helped if you included that in your question. It means "Proxy authentication required". Please make sure your proxy username/password is correct. – Niraj Shah Mar 13 '17 at 14:47
  • My bad, I forget a letter in username :s... Now I've the following message error : "unable to load client key: -8178 (SEC_ERROR_BAD_KEY)" – LynxWeb Mar 13 '17 at 15:00
  • Check that the location and filename of the certificate is correct. – Niraj Shah Mar 13 '17 at 15:07
  • I specified the location & it's good but when I see what happen I get this : * Initializing NSS with certpath: sql:/etc/pki/nssdb * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * unable to load client key: -8178 (SEC_ERROR_BAD_KEY) * NSS error -8178 (SEC_ERROR_BAD_KEY) * Peer's public key is invalid. * Closing connection 0 – LynxWeb Mar 13 '17 at 15:27
  • According to your command line, the certificate is in `C:\temp\certificat.pem`, but the location in your PHP file is different. Please check that file is in correct folder, and that you're pointing the code to correct location. Error clearly says `unable to load client key`. – Niraj Shah Mar 13 '17 at 15:49
  • c:\temp is just an exemple. The certificat.pem is here : /var/www/html/my_application/certificats/certificat.pem so in PHP I've this location. But it seems It initialize the wrong certificat in the wrong path – LynxWeb Mar 13 '17 at 16:02
  • See what `__DIR__` points to and make sure file path is correct. You many need to replace `__DIR__` with `../` instead. – Niraj Shah Mar 13 '17 at 16:11
  • I replace `__DIR__`with absolute path & nothing happen I still get : * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * unable to load client key: -8178 (SEC_ERROR_BAD_KEY) * NSS error -8178 (SEC_ERROR_BAD_KEY) * Peer's public key is invalid. * Closing connection 3 – LynxWeb Mar 14 '17 at 08:49
  • The issue is still to do with the certificate or passphrase. Check that the certificate is in valid pem format. – Niraj Shah Mar 14 '17 at 09:55
  • I change my code & I added curl_setopt($ch, CURLOPT_CAPATH, "/var/www/html/myapplication/certificats"); & I see the following message failed to load '/var/www/html/myapplication/certificats/certServeurTM.pem' from CURLOPT_CAPATH. You may see it in next answer – LynxWeb Mar 14 '17 at 10:02
  • Check that the pem file has correct permissions to allow read the file. – Niraj Shah Mar 14 '17 at 10:50
  • I set to 777 temporarily just for testing & still have this message – LynxWeb Mar 14 '17 at 10:56
0

by checking curl's --libcurl parameter, it seems:

you forgot to set CURLOPT_PROXYAUTH to CURLAUTH_NTLM.

you forgot to set CURLOPT_USERAGENT to your version of curl (curl cli does this automatically, libcurl does not. on my system, it is "curl/7.52.1").

it seems you mixed CURLOPT_SSLCERTPASSWD with CURLOPT_KEYPASSWD.

here's the --libcurl file, you could try converting that to PHP:

/********* Sample code generated by the curl command line tool **********
 * All curl_easy_setopt() options are documented at:
 * https://curl.haxx.se/libcurl/c/curl_easy_setopt.html
 ************************************************************************/
#include <curl/curl.h>

int main(int argc, char *argv[])
{
  CURLcode ret;
  CURL *hnd;
  struct curl_slist *slist1;

  slist1 = NULL;
  slist1 = curl_slist_append(slist1, "depth:1");

  hnd = curl_easy_init();
  curl_easy_setopt(hnd, CURLOPT_URL, "https://www.url.fr/to/webdav/number/folder/");
  curl_easy_setopt(hnd, CURLOPT_NOPROGRESS, 1L);
  curl_easy_setopt(hnd, CURLOPT_PROXY, "http://proxyurl:80");
  curl_easy_setopt(hnd, CURLOPT_PROXYUSERPWD, ":");
  curl_easy_setopt(hnd, CURLOPT_PROXYAUTH, (long)CURLAUTH_NTLM);
  curl_easy_setopt(hnd, CURLOPT_USERAGENT, "curl/7.52.1");
  curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, slist1);
  curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
  curl_easy_setopt(hnd, CURLOPT_HTTP_VERSION, (long)CURL_HTTP_VERSION_2TLS);
  curl_easy_setopt(hnd, CURLOPT_KEYPASSWD, "tempcertificat.pem:certifPassword");
  curl_easy_setopt(hnd, CURLOPT_SSLCERT, "C");
  curl_easy_setopt(hnd, CURLOPT_SSL_VERIFYPEER, 0L);
  curl_easy_setopt(hnd, CURLOPT_SSL_VERIFYHOST, 0L);
  curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "PROPFIND");
  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);

  /* Here is a list of options the curl code used that cannot get generated
     as source easily. You may select to either not use them or implement
     them yourself.

  CURLOPT_WRITEDATA set to a objectpointer
  CURLOPT_INTERLEAVEDATA set to a objectpointer
  CURLOPT_WRITEFUNCTION set to a functionpointer
  CURLOPT_READDATA set to a objectpointer
  CURLOPT_READFUNCTION set to a functionpointer
  CURLOPT_SEEKDATA set to a objectpointer
  CURLOPT_SEEKFUNCTION set to a functionpointer
  CURLOPT_ERRORBUFFER set to a objectpointer
  CURLOPT_STDERR set to a objectpointer
  CURLOPT_HEADERFUNCTION set to a functionpointer
  CURLOPT_HEADERDATA set to a objectpointer

  */

  ret = curl_easy_perform(hnd);

  curl_easy_cleanup(hnd);
  hnd = NULL;
  curl_slist_free_all(slist1);
  slist1 = NULL;

  return (int)ret;
}
/**** End of sample code ****/
hanshenrik
  • 19,904
  • 4
  • 43
  • 89
0

Finally I get it !!

In fact, the person in charge of certifacts management forget to tell me that I need another private key & private certificat...

So here my final code : 

curl_setopt($ch, CURLOPT_URL, $urlPropfind);
  curl_setopt($ch, CURLOPT_NOPROGRESS, true);
  curl_setopt($ch, CURLOPT_PROXY, $proxyAdresse);
  curl_setopt($ch, CURLOPT_PROXYUSERPWD, $proxyIdentification);
  curl_setopt($ch, CURLOPT_PROXYAUTH, CURLAUTH_NTLM);
  curl_setopt($ch, CURLOPT_USERAGENT, "curl/7.29.0");
  curl_setopt($ch, CURLOPT_HTTPHEADER, array($header));
  curl_setopt($ch, CURLOPT_MAXREDIRS, 50);
  curl_setopt($ch, CURLOPT_SSLCERTPASSWD, "toulouse31");
  curl_setopt($ch, CURLOPT_SSLCERT, "/var/www/html/myapplication/certificats/certServeurTM.pem");  
  curl_setopt($ch, CURLOPT_SSLCERT, "/var/www/html/myapplication/certificats/default.crt");  
  curl_setopt($ch, CURLOPT_SSLKEY, "/var/www/html/myapplication/certificats/default.privkey"); 
  curl_setopt($ch, CURLOPT_SSL_VERIFYPEER,true);
  curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
  curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "PROPFIND");
  curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  curl_setopt( $ch, CURLOPT_VERBOSE, true );
  curl_setopt( $ch, CURLOPT_STDERR, fopen('php://output', 'w') );

Thanks, everyone, for your help :)

LynxWeb
  • 69
  • 1
  • 9