Curl https skips ssl authentication in PHP and reports error

This article mainly shares with you the analysis and solutions to the error reporting problem of Curl https skipping ssl authentication in PHP. I hope it can help everyone.

function get($url = '', $cookie = ''){
  $ch = curl_init();
  curl_setopt($ch, CURLOPT_URL, $url);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); //将curl_exec()获取的信息以文件流的形式返回，而不是直接输出。
  curl_setopt($ch, CURLOPT_HEADER, 0);
  curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); // 对认证证书来源的检查
  curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); // 从证书中检查SSL加密算法是否存在
  curl_setopt($ch, CURLOPT_SSLVERSION, 2);//设置SSL协议版本号
  if($cookie){
      curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie);
      curl_setopt ($ch, CURLOPT_REFERER,'https://wx.qq.com');
    }
  curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);
  curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);  $output = curl_exec($ch);  if ( curl_errno($ch) )    return curl_error($ch);
  curl_close($ch);  return $output;
}

The above method is the function for user curl to initiate https request. The CURLOPT_SSLVERSION item specifies the SSL protocol version. Many codes on the Internet say that it can be set to 1/2/3, but the results of my test are as follows:

1. When set to 1, the following error will be reported in PHP 5.2.11 version:
   “error:14077458:SSL routines:SSL23_GET_SERVER_HELLO:reason(1112)”
   Error reported here The reason is that the version of openssl in your php is too low. The solution is to upgrade your php to 5.3.60 (I haven’t tested which version is higher, it should be ok as long as the openssl version is greater than 0.9.8)

2. When set to 2, the following error will be reported:
   Linux environment error: "SSL version range is not valid."
   Windows environment error: "OpenSSL was built without SSLv2 support"
   This should be easier to understand because the version number of the SSL protocol is invalid.

3. When set to 3, the following error will be reported:
   Linux environment error: "Encountered end of file".
   Error reported in Windows environment: “Unknown SSL protocol error in connection to login.wx.qq.com:443 ”
   After checking the information online, I think the reason for this error is due to security vulnerabilities in SSLV2 and SSLV3, so WeChat has The SSLV2 and SSLV3 protocol versions are no longer used, so an error will occur when we set it to 3.

function get($url = '', $cookie = ''){
  $ch = curl_init();
  curl_setopt($ch, CURLOPT_URL, $url);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); //将curl_exec()获取的信息以文件流的形式返回，而不是直接输出。
  curl_setopt($ch, CURLOPT_HEADER, 0);
  curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); // 对认证证书来源的检查
  curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); // 从证书中检查SSL加密算法是否存在
  curl_setopt($ch, CURLOPT_SSLVERSION, 2);//设置SSL协议版本号
  if($cookie){
      curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie);
      curl_setopt ($ch, CURLOPT_REFERER,'https://wx.qq.com');
    }
  curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);
  curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);  $output = curl_exec($ch);  if ( curl_errno($ch) )    return curl_error($ch);
  curl_close($ch);  return $output;
}

The above method is the function for user curl to initiate https request. The CURLOPT_SSLVERSION item specifies the SSL protocol version. Many codes on the Internet say that it can be set to 1/2/3, but I tested it. The result is as follows:

1. When set to 1, the following error will be reported in PHP 5.2.11 version:
   “error:14077458:SSL routines:SSL23_GET_SERVER_HELLO:reason(1112)”
   The reason for the error reported here is that the version of openssl in your php is too low. The solution is to upgrade your php to 5.3.60 (I have not tested which version is higher than it. It should be as long as the openssl version is greater than 0.9.8. Yes)

2. When set to 2, the following error will be reported:
   Linux environment error: "SSL version range is not valid."
   Windows environment error: "OpenSSL was built without SSLv2 support”
   This should be easier to understand, that is, the version number of the SSL protocol is invalid.

3. When set to 3, the following error will be reported:
   Linux environment error:” Encountered end of file”.
   Error reported in Windows environment: “Unknown SSL protocol error in connection to login.wx.qq.com:443 ”
   After checking the information online, I think the reason for this error is due to SSLV2 and SSLV3 There are security holes, so WeChat no longer uses SSLV2 and SSLV3 protocol versions, so an error will occur when we set it to 3.

Related recommendations:

Configuring SSL authentication (https) used by PHP in Nginx environment

The above is the detailed content of Curl https skips ssl authentication in PHP and reports error. For more information, please follow other related articles on the PHP Chinese website!