php 带有自签名证书的 POST 请求

POST request with a self-signed certificate

提问by Aaron

I'm going to POST some data from site A to site B using PHP. Site A has a commercial SSL certificate. Site B is going to have a self-signed certificate. Is this doable? If not, are there any configuration options in PHP (or Apache) that I can set to bypass the restrictions?

我将使用 PHP 将一些数据从站点 A 发布到站点 B。站点 A 具有商业 SSL 证书。站点 B 将拥有自签名证书。这是可行的吗？如果没有，我可以设置 PHP（或 Apache）中的任何配置选项来绕过这些限制吗？

回答by Marc B

Presumably you'll be using curl on server A? There's a couple options in curl to disable certificate validation, which'll allow self-signed certs through. The link will still be encrypted, but you won't be able to trust that server B really ISserver B:

想必您会在服务器 A 上使用 curl 吗？curl 中有几个选项可以禁用证书验证，这将允许自签名证书通过。该链接仍将被加密，但您将无法相信服务器 B 真的是服务器 B：

curlopt_ssl_verifypeer  (checking the CA auth chain)
curlopt_ssl_verifyhost  (hostname/certname match checks)

Example PHP code:

示例 PHP 代码：

$ch = curl_init("https://example.com/example/path"); 
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$response = curl_exec($ch);

回答by drew010

It's doable. In PHP, if you are using cURL to perform the POST, you just need to set the options CURLOPT_SSL_VERIFYPEERand CURLOPT_SSL_VERIFYHOSTto false so it doesn't fail because the certificate is self signed.

这是可行的。在PHP中，如果您使用的卷曲进行后，你只需要设置的选项CURLOPT_SSL_VERIFYPEER，并CURLOPT_SSL_VERIFYHOST以虚假的，因此不会失败，因为证书是自签名。

回答by GargantuChet

If you are asking the browser to POST the data, then the user will get the normal warnings about the certificate not being trusted.

如果您要求浏览器 POST 数据，那么用户将收到有关证书不受信任的正常警告。

If you're using cURL to perform the POST from within your PHP code, you'll want to disable cURL's SSL checks. According to a related question,

如果您在 PHP 代码中使用 cURL 执行 POST，您需要禁用 cURL 的 SSL 检查。根据一个相关的问题，

You'll need to set CURLOPT_SSL_VERIFYPEERand CURLOPT_SSL_VERIFYHOSTto FALSE. This should > disable the two main checks. They may not both be required, but this should at least get you going.

您需要将CURLOPT_SSL_VERIFYPEER和设置CURLOPT_SSL_VERIFYHOST为FALSE。这应该 > 禁用两个主要检查。它们可能不是必需的，但这至少应该让你前进。

回答by David Spector

In my case, only my development server is self-signed, so I set the verifypeer option to false and it works. But my production server is fully signed, so I do not set the verifypeer option. In either case, the verifyhost option is unnecessary.

就我而言，只有我的开发服务器是自签名的，所以我将 verifypeer 选项设置为 false 并且它可以工作。但是我的生产服务器是完全签名的，所以我没有设置 verifypeer 选项。无论哪种情况，都不需要 verifyhost 选项。

回答by Dominik K

Answers suggesting to disable CURLOPT_SSL_VERIFYPEERshould not be accepted. The question is "Why doesn't it work with cURL", and as correctly pointed out it is dangerous. Disabling certificate checks opens the door for man in the middle attacks, which comes close to using just plain text http.

CURLOPT_SSL_VERIFYPEER不应接受建议禁用的答案。问题是“为什么它不适用于 cURL”，正如正确指出的那样，它很危险。禁用证书检查为中间人攻击打开了大门，这接近于仅使用纯文本 http。

The error is probably caused by not having an up-to-date bundle of CA root certificates. This is typically a text file with a bunch of cryptographic signatures that curl uses to verify a host's SSL certificate.

该错误可能是由于没有最新的 CA 根证书包引起的。这通常是一个带有一堆加密签名的文本文件，curl 使用这些签名来验证主机的 SSL 证书。

You need to make sure that your installation of PHP has one of these files, and that it's up to date (otherwise download one here: http://curl.haxx.se/docs/caextract.html).

您需要确保您的 PHP 安装具有这些文件之一，并且它是最新的（否则请在此处下载：http: //curl.haxx.se/docs/caextract.html）。

Then set in php.ini:

然后在php.ini中设置：

curl.cainfo = <absolute_path_to> cacert.pem

If you are setting it at runtime, use:

如果您在运行时设置它，请使用：

curl_setopt ($ch, CURLOPT_CAINFO, dirname(__FILE__)."/cacert.pem");

Answer copied from https://stackoverflow.com/a/23585500/2650835for security reasons.

出于安全原因，从https://stackoverflow.com/a/23585500/2650835复制的答案。