如何在PHP服务器中安全地从PHP建立TLS连接 [英] How to make TLS connection from PHP in web server, and safely

问题描述

假设我有一些PHP代码在web服务器中运行，例如，运行一个简单的CakePHP应用程序。从这个应用程序，我想偶尔做一个TLS连接到一些服务器交换一些数据。这是如何做到的？ （我对PHP没有什么经验。）

Suppose I have some PHP code running inside a web server, for example, running a simple CakePHP app. From this app, I want to occasionally make a TLS connection out to some server to exchange some data. How is this typically done? (I have little experience with PHP.)

建议使用什么PHP插件或库等来完成TLS连接？一些好地方在哪里开始寻找？ （我最初的Google搜索给我一个巨大的噪音与信号的比率。）

What PHP plug-ins or libraries or whatever, are recommended to accomplish TLS connections? Where are some good places to start looking? (My initial Google searches give me a huge ratio of noise to signal.)

将X509私钥坐在Web服务器上涉及的安全问题是什么？要使TLS连接断开，我将需要X509证书和相应的私钥，作为可能的PEM文件或DER文件，或在Java密钥库或任何其他。这个私钥是否会位于web根下的某个易受攻击的地方？这通常如何处理？什么是安全问题，具体来说，是保护用于建立TLS连接的私钥？最佳做法是什么？

What are the security issues involved with having the X509 private key sitting on the web server? To make a TLS connection out, I'm going to need both the X509 certificate and the corresponding private key, as perhaps PEM files, or DER files, or in a Java keystore, or whatever. Is that private key going to be sitting somewhere vulnerable under the web root? How is this typically handled? What are the security issues, specifically, of securing the private key that is to be used to make a TLS connection out? What are the best practices?

编辑：我忘记提及PHP应用程序连接的服务器需要提供客户端证书。客户端 需要私钥来连接。此外，我要连接的服务器不是 HTTP服务器 - 我只需要在服务器的普通套接字连接（通过SSL / TLS连接）上读/写。

I forgot to mention that the server that the PHP app connects to requires a client certificate to be presented. The client does need the private key to connect. Also, the server I am connecting to is not an HTTP server -- I just need to read/write on a plain socket connection to the server (over the SSL/TLS connection).

推荐答案

TLS是正确的名称，但大多数人仍称之为SSL。在PHP中，您可以建立此连接使用CURL 。

TLS is the proper name, however most people still call it SSL. In PHP you can make this connection using CURL.

使用TLS / SSL客户端，您只需要使用公钥来验证远程主机。这个公钥只是公开的，不管它是否泄漏给攻击者都没关系。在服务器端Apache可以访问公钥和私钥。这些密钥使用正常的文件访问权限进行保护。在* nix系统下，这些键通常存储在Apache进程拥有的 / etc / 中， chmod 400 最好。

With a TLS/SSL client you only need the public key to verify a remote host. This public key is just that public, it doesn't matter if it gets leaked to an attacker. On the server side Apache has access both the public and private key. These keys are protected using normal file access privileges. Under *nix systems these keys are commonly stored somewhere in /etc/, owned by the Apache process and chmod 400 is best.

客户端最简单的身份验证方法是简单的用户名/密码。您可以使用SSL来验证客户端和服务器。这将要求您将私钥存储在您的PHP应用程序可访问的位置，理想情况下在webroot外面使用 chmod 400 ，但是您可以轻松地将其重命名为.php或将其放在包含拒绝所有的.htaccess的文件夹中。在服务器端，您可以使用这些环境变量验证客户端证书。

The easiest authentication method for clients would be a simple username/password. You can use SSL to authenticate both the client and server. This would require you to store the private key somewhere where your PHP app has access, ideally outside of the webroot with a chmod 400, but you could easily rename it to .php or put it in a folder with a .htaccess that contains deny from all. On the server side you can verify the clients certificate using these environmental variables.

如果您只想使用TLS连接，而不是HTTPs。然后，您可以通过设置上下文选项使用stream_context_set_option：

If you just want a TLS connection and not an HTTPs. Then you can use stream_context_set_option by setting the Context Options:

<?php 
$context = stream_context_create(); 
$result = stream_context_set_option($context, 'ssl', 'local_cert', '/path/to/keys.pem'); 
// This line is needed if your cert has a passphrase
$result = stream_context_set_option($context, 'ssl', 'passphrase', 'pass_to_access_keys'); 

$socket = stream_socket_client('tls://'.$host.':443', $errno, $errstr, 30, STREAM_CLIENT_CONNECT, $context); 
?>

这篇关于如何在PHP服务器中安全地从PHP建立TLS连接的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！