0

Hi all, can't connect to the remote server over https.

This is my code:

$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, "https://remote_ip:9192/?doc");
curl_setopt($ch, CURLOPT_SSLCERT, $private_key);
curl_setopt($ch, CURLOPT_SSLCERTPASSWD, $secret_word);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_PROXY, '');
curl_setopt($ch, CURLOPT_CAINFO, getcwd().$server_key);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);

$output = curl_exec($ch);
$res = curl_error($ch);
var_dump(openssl_get_cert_locations());
echo $res;

And I receive next output:

array (size=8)
  'default_cert_file' => string '/usr/lib/ssl/cert.pem' (length=21)
  'default_cert_file_env' => string 'SSL_CERT_FILE' (length=13)
  'default_cert_dir' => string '/usr/lib/ssl/certs' (length=18)
  'default_cert_dir_env' => string 'SSL_CERT_DIR' (length=12)
  'default_private_dir' => string '/usr/lib/ssl/private' (length=20)
  'default_default_cert_area' => string '/usr/lib/ssl' (length=12)
  'ini_cafile' => string '/srv/site/keys/mycert.pem' (length=31)
  'ini_capath' => string '' (length=0)
SSL certificate problem: unable to get local issuer certificate

I even try to add pem file to php.ini config:

curl.cainfo="/srv/site/keys/mycert.pem" openssl.cafile="/srv/site/keys/mycert.pem"

Certificate are good, if I make request in terminal by curl:

curl --noproxy "*" --cacert mycert.pem --cert newfile.pem:password -k https://remote_ip:9192/?doc

I will receive doc fro mremote server.

Whats wrong in my php script?

user2264941
  • 407
  • 1
  • 8
  • 23
  • https://stackoverflow.com/a/4372730/3481654 – Beginner Nov 07 '18 at 07:36
  • It is wrong to disabled CURLOPT_SSL_VERIFYPEER – user2264941 Nov 07 '18 at 07:39
  • Setting CURLOPT_SSL_VERIFYPEER to false allows for man-in-the-middle-attacks. – user2264941 Nov 07 '18 at 07:40
  • HTTPS is not really supposed to work with IP addresses in URLs, at least if you want default features with certificates, as those are most often on hostnames, not on IP addresses. Also based on its name `CURLOPT_CAINFO` should point to a certificate and not a key as you seem to do based on your variable names. – Patrick Mevzek Nov 07 '18 at 15:04

0 Answers0