PHP Curl(带 NSS)在连接到 https 时可能使用 SSLv3 而不是 TLS [英] PHP Curl (with NSS) is probably using SSLv3 instead of TLS when connecting to https
问题描述
我在 PHP 中使用 curl 库(带有 NSS)连接到我的其他服务器.一切都很好，直到上周目标服务器由于贵宾犬漏洞(顺便说一下 CloudFlare)而停止支持 SSLv3.现在，我正在尝试使用 TLS 建立连接，但我仍然收到SSL 连接错误".
I'm using curl library (with NSS) in PHP to connect to my other server. Everything was fine until last week, when the destination server stoped supporting SSLv3 due to poodle vulnerability (CloudFlare by the way). Now, I'm trying to make connection using TLS, but I'm still getting "SSL connect error".
有示例代码，我正在使用:
There is sample code, I'm using:
$ch = curl_init();
curl_setopt_array( $ch, array(
CURLOPT_URL => 'https://www.lumiart.cz',
CURLOPT_RETURNTRANSFER => true,
CURLOPT_SSLVERSION => 1,
CURLOPT_SSL_VERIFYPEER => false,
CURLOPT_VERBOSE => true
) );
$output = curl_exec( $ch );
echo $output;
print_r( curl_getinfo( $ch ) );
echo 'error:' . curl_error( $ch );
curl_close($ch);
根据我的理解，将 CURLOPT_SSLVERSION 设置为 1 应该强制通过 TLS 连接.
From my understanding, setting CURLOPT_SSLVERSION to 1 should force connection via TLS.
注意:我有 CURLOPT_SSL_VERIFYPEER =>false 只是为了调试，一旦我解决了这个问题，我不想把它留在那里.
Note: I have CURLOPT_SSL_VERIFYPEER => false just for debuging and I'm not meaning to leave it there, once I figure this problem out.
这是输出:
Array
(
[url] => https://www.lumiart.cz
[content_type] =>
[http_code] => 0
[header_size] => 0
[request_size] => 0
[filetime] => -1
[ssl_verify_result] => 0
[redirect_count] => 0
[total_time] => 0
[namelookup_time] => 2.3E-5
[connect_time] => 0.005777
[pretransfer_time] => 0
[size_upload] => 0
[size_download] => 0
[speed_download] => 0
[speed_upload] => 0
[download_content_length] => -1
[upload_content_length] => -1
[starttransfer_time] => 0
[redirect_time] => 0
[certinfo] => Array
(
)
[primary_ip] => 2400:cb00:2048:1::681c:86f
[redirect_url] =>
)
error:SSL connect error
我在共享主机提供商处拥有所有这些，因此我无法更改任何 php.ini 配置或更新任何组件.我所拥有的只是 phpinfo().我已经检查了这些组件版本的 TLS 支持，应该没问题.这是phpinfo的摘录:
I have all of this at shared hosting provider, so I can't change any php.ini configuration or update any components. All I have is phpinfo(). I've checked for TLS support on these components version and it should be fine. Here is excerpt of phpinfo:
PHP Version 5.4.32
System Linux wl42-f262 2.6.32-431.5.1.el6.x86_64 #1 SMP Wed Feb 12 00:41:43 UTC 2014 x86_64
curl:
cURL support enabled
cURL Information 7.19.7
Age 3
Features
AsynchDNS No
Debug No
GSS-Negotiate Yes
IDN Yes
IPv6 Yes
Largefile Yes
NTLM Yes
SPNEGO No
SSL Yes
SSPI No
krb4 No
libz Yes
CharConv No
Protocols tftp, ftp, telnet, dict, ldap, ldaps, http, file, https, ftps, scp, sftp
Host x86_64-redhat-linux-gnu
SSL Version NSS/3.15.3
ZLib Version 1.2.3
libSSH Version libssh2/1.4.2
我认为，这个问题是使用 SSLv3 而不是 TLS，但我不是 100% 确定.我得到的只是SSL 连接错误"，我不知道如何找出用于连接的 SSL 版本.
I think, that problem is usage of SSLv3 instead of TLS, but I'm not 100% sure. All I'm getting is "SSL connect error" and I don't know, how to find out, which SSL version was used to connect.
有没有办法，如何检查，哪个 SSL 版本用于连接?还是我遗漏了什么?
Is there a way, how to check, which SSL version is used for connection? Or am I missing something?
推荐答案
这是一个有趣的问题.
如果您为该站点查询 SSLLabs你会看到，它只支持各种 ECDHE-ECDSA-* 密码，不支持其他密码.但是，在 curl 的版本历史 中，您会发现 ECC 密码和 NSS 库(您使用的)的错误仅在 curl 版本 7.36 nss:如果 NSS 实现 ECC 密码，则允许使用它们" 中修复.
If you query SSLLabs for this site you will see, that it only supports various ECDHE-ECDSA-* ciphers and no other ciphers. But, in the version history of curl you will find a bug with ECC ciphers and the NSS library (which you use) which is only fixed in curl version 7.36 "nss: allow to use ECC ciphers if NSS implements them".
由于您使用的是 curl 7.19.7，因此您的 curl 太旧，无法将必要的密码与 NSS 库一起使用.这意味着您需要升级 curl 库.
Since you are using curl 7.19.7 your curl is too old to use the necessary ciphers together with the NSS library. This means you need to upgrade your curl library.
这篇关于PHP Curl(带 NSS)在连接到 https 时可能使用 SSLv3 而不是 TLS的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
