php osx 10.10 Curl POST 到 HTTPS url 给出 SSLRead() 错误

osx 10.10 Curl POST to HTTPS url gives SSLRead() error

提问by Mattijs

I just recently upgraded to OSX 10.10 Yosemite and I since the upgrade I can't do Curl POST to a SSL url anymore.

我最近刚刚升级到 OSX 10.10 Yosemite，自从升级后我无法再对 SSL url 执行 Curl POST。

I first used wordpress's wp_remote_requestcall and also tried to use curl in php. Both (as expected) give the same error message:

我首先使用wordpress的wp_remote_request调用，也尝试在php中使用curl。两者（如预期）都给出相同的错误消息：

Error Number:56

Error String:SSLRead() return error -9806

错误编号：56

错误字符串：SSLRead() 返回错误 -9806

Note: when I curl POST to HTTP it works fine. I reckon it is a setting in PHP.ini or in my apache (I lost my original HTTPD.conf file after upgrade...).

注意：当我将 POST 卷曲到 HTTP 时，它工作正常。我认为这是 PHP.ini 或我的 apache 中的设置（升级后我丢失了原始的 HTTPD.conf 文件......）。

Can anyone help me out?

谁能帮我吗？

回答by Asaph

I've seen this error happen when php is compiled with a version of cURL that uses Apple's Secure Transportunder Yosemite and the target of the URL request doesn't support SSLv3 (which was probably disabled due to the POODLE vulnerability). What is the output of this command?

我已经看到当使用在 Yosemite 下使用Apple 安全传输的 cURL 版本编译 php并且 URL 请求的目标不支持 SSLv3（可能由于POODLE 漏洞而被禁用）时，会发生此错误。这个命令的输出是什么？

$ php -i | grep "SSL Version"

I suspect you'll see this:

我怀疑你会看到这个：

SSL Version => SecureTransport

You can overcome this by installing a version of php which uses a version of cURL which uses OpenSSL instead of SecureTransport. This is most easily done with homebrew. So install that first if you don't already have it. If homebrew is installed but you haven't run brew updatesince upgrading to Yosemite, do that first. Also make sure you've installed XCode >= 6.1 and the latest XCode command line tools. brew doctorwill tell you if you've done it all right.

您可以通过安装使用 cURL 版本的 php 版本来克服这个问题，该版本使用 OpenSSL 而不是 SecureTransport。使用homebrew最容易做到这一点。因此，如果您还没有它，请先安装它。如果安装了自制软件，但brew update升级到优胜美地后您还没有运行，请先执行此操作。还要确保您已安装 XCode >= 6.1 和最新的 XCode 命令行工具。brew doctor会告诉你是否做对了。

Add the Homebrew taps below that you will need in order to get brewed php installed. Skip this step if these repos are already tapped. If you're unsure if these repos are already tapped, just run the commands below. Worst case scenario, you'll get a harmless Warning: Already tapped!

在下面添加您需要的 Homebrew 水龙头，以便安装 brewed php。如果这些 repos 已经被挖掘，请跳过这一步。如果您不确定这些存储库是否已被使用，只需运行以下命令即可。最坏的情况，你会得到一个无害的Warning: Already tapped!

$ brew tap homebrew/dupes
$ brew tap homebrew/versions
$ brew tap homebrew/php

Then install curl with openssl:

然后使用 openssl 安装 curl：

$ brew install --with-openssl curl

Then install php using the curl you just installed and brewed openssl:

然后使用刚刚安装的 curl 安装 php 并生成 openssl：

$ brew install --with-homebrew-curl --with-httpd24 php55

• if using apache, make sure to add LoadModule php5_module /usr/local/opt/php55/libexec/apache2/libphp5.soto your /etc/apache2/httpd.confand restart apache.

• if not using apache 2.4, you can remove --with-httpd24from the above command.

• if using nginx, follow the caveat instuctions for starting fpm:

  To launch php-fpm on startup:

  mkdir -p ~/Library/LaunchAgents
  cp /usr/local/opt/php55/homebrew.mxcl.php55.plist ~/Library/LaunchAgents/
  launchctl load -w ~/Library/LaunchAgents/homebrew.mxcl.php55.plist
  

• 如果使用 apache，请确保添加LoadModule php5_module /usr/local/opt/php55/libexec/apache2/libphp5.so到您的/etc/apache2/httpd.conf并重新启动 apache。

• 如果不使用 apache 2.4，您可以--with-httpd24从上面的命令中删除。

• 如果使用 nginx，请遵循启动 fpm 的警告说明：

  在启动时启动 php-fpm：

  mkdir -p ~/Library/LaunchAgents
  cp /usr/local/opt/php55/homebrew.mxcl.php55.plist ~/Library/LaunchAgents/
  launchctl load -w ~/Library/LaunchAgents/homebrew.mxcl.php55.plist
  

Install any php extensions you're going to need eg. mcrypt.

安装您需要的任何 php 扩展，例如。mcrypt.

$ brew install php55-mcrypt

After you're done, run this again:

完成后，再次运行：

$ php -i | grep "SSL Version"

And you should see:

你应该看到：

SSL Version => OpenSSL/1.0.2h

And now, re-test your application and the SSLRead() return error -9806should go away.

现在，重新测试您的应用程序，SSLRead() return error -9806应该会消失。

回答by kenorb

This SSL error (OSStatus code: 9806) means that your connection is terminated by the server due to an error in establishing the connection (e.g. on some invalid command). This seems to happens only on occasions when the SSL connection to remote host drops in between.

此 SSL 错误（OSStatus 代码：9806）意味着您的连接由于建立连接时出现错误（例如某些无效命令）而被服务器终止。这似乎仅在与远程主机的 SSL 连接介于两者之间时才会发生。

This is not well documented by SSL manual (SSL_get_error), however this error message comes from libcurlbuilt which is used by the SecureTransport/Darwinssl TLS backend (you can find its OSStatus in SecureTransport.hheader file):

这在 SSL 手册 ( SSL_get_error) 中没有得到很好的记录，但是此错误消息来自libcurlSecureTransport/Darwinssl TLS 后端使用的 build（您可以在SecureTransport.h头文件中找到它的 OSStatus ）：

errSSLClosedAbort           = -9806,    /* connection closed via error */

From my experience, this usually happens when you're behind the proxy or connected to a limited network which uses authentication mechanism.

根据我的经验，这通常发生在您位于代理后面或连接到使用身份验证机制的有限网络时。

So please verify that you're connected to the right network (via WiFi) and your other HTTPS works correctly. If not, check if you need to specify proxy credentials or your ISP is overriding the certificate chain and requires some kind of authentication or it's basically blocking access to certain sites in their firewall.

因此，请确认您已连接到正确的网络（通过 WiFi）并且您的其他 HTTPS 工作正常。如果没有，请检查您是否需要指定代理凭据，或者您的 ISP 是否覆盖了证书链并需要某种身份验证，或者它基本上阻止了对防火墙中某些站点的访问。

回答by Daniel Batalla

I had a similar issue with SSLRead() return error -9806error, and also I had SSL Version => SecureTransport.

我有一个类似的SSLRead() return error -9806错误问题，我也有SSL Version => SecureTransport.

But in my case the problem was that I was setting curl CURLOPT_HTTP_VERSIONoption:

但就我而言，问题是我正在设置 curlCURLOPT_HTTP_VERSION选项：

$curl = curl_init();    
curl_setopt($curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_0);

If you remove that option, cURL will decide which version to use by default. Check curl_setoptdocumentation for more.

如果删除该选项，cURL 将决定默认使用哪个版本。查看curl_setopt文档了解更多信息。

That worked for me, and I didn't need to change anything with cURL nor PHP. But this is a solution of one of many cases where error -9806appears.

这对我有用，而且我不需要使用 cURL 或 PHP 更改任何内容。但这是error -9806出现的许多情况之一的解决方案。