我希望能够使用CURL读取SSL证书信息.从Linux控制台我得到这个响应头:
GET https://www.google.com/ -ed
Cache-Control: private, max-age=0
Connection: close
Date: Sun, 20 Jun 2010 21:34:12 GMT
Server: gws
Content-Type: text/html; charset=ISO-8859-1
Expires: -1
Client-Date: Sun, 20 Jun 2010 21:34:18 GMT
Client-Peer: 66.102.13.106:443
Client-Response-Num: 1
Client-SSL-Cert-Issuer: /C=ZA/O=Thawte Consulting (Pty) Ltd./CN=Thawte SGC CA
Client-SSL-Cert-Subject: /C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com
Client-SSL-Cipher: RC4-SHA
Client-SSL-Warning: Peer certificate not verified
Set-Cookie: PREF=ID=4d56960f6e3ad831:TM=1277069652:LM=1277069652:S=GF-w8Yc-_61NBzzJ; expires=Tue, 19-Jun-2012 21:34:12 GMT; path=/; domain=.google.com
Title: Google
X-XSS-Protection: 1; mode=block
但是使用CURL,标题要短得多:
HTTP/1.1 200 OK
Date: Sun, 20 Jun 2010 21:39:07 GMT
Expires: -1
Cache-Control: private, …我需要确保SMTP服务器证书由公共证书颁发机构签名.我想使用phpseclib或其他一些受信任的库.我相信我可以使用从Firefox中提取的根证书.
这里有一些家庭酿造方法来检查证书日期和其他元数据,但它看起来不像任何签名检查那样(除了确保OpenSSL这样做).无论如何,我想使用一个库 - 我想写尽可能少的证书处理代码,因为我不是一个密码学家.
也就是说,上面链接的答案仍然非常有用,因为它帮助我获取了一些代码来从TLS对话中获取证书:
$url = "tcp://{$domain}:{$port}";
$connection_context_option = [
'ssl' => [
'capture_peer_cert' => true,
'verify_peer' => false,
'verify_peer_name' => false,
'allow_self_signed' => true,
]
];
$connection_context = stream_context_create($connection_context_option);
$connection_client = stream_socket_client($url, $errno, $errstr, 30, STREAM_CLIENT_CONNECT, $connection_context);
stream_set_timeout($connection_client, 2);
fread($connection_client, 10240);
fwrite($connection_client,"HELO alice\r\n");
fread($connection_client, 10240);
fwrite($connection_client, "STARTTLS\r\n");
fread($connection_client, 10240);
$ok = stream_socket_enable_crypto($connection_client, TRUE, STREAM_CRYPTO_METHOD_SSLv23_CLIENT);
if ($ok === false)
{
return false;
}
$connection_info = stream_context_get_params($connection_client);
openssl_x509_export($info["options"]["ssl"]["peer_certificate"], $pem_encoded);
(请注意,我已经故意关闭了证书验证.这是因为我无法控制运行的主机,它们的证书可能已经过旧或配置错误.因此,无论连接验证如何,我都希望获取证书我正在使用,然后使用cacert.pem我将提供的内容自行验证.)
那将给我这样的证书.这个是Microsoft的Live.com电子邮件服务器smtp.live.com:587:
-----BEGIN …案例:我想打开SSL连接,localhost而SSL证书是FQDN的问题.
问题:如果没有特殊处理,(*)下面的程序将失败并显示以下消息:
PHP Warning: stream_socket_enable_crypto(): Peer certificate CN='myhost.com' did not match expected CN='localhost' in test.php
测试PHP程序:
$fp = stream_socket_client("tcp://localhost:993", $errno, $errstr, 30);
// (*) if commented, the program fails
//stream_context_set_option($fp, 'ssl', 'verify_peer_name', false);
if (!$fp) {
die("Unable to connect: $errstr ($errno)");
}
if (!stream_socket_enable_crypto($fp, true, STREAM_CRYPTO_METHOD_TLS_CLIENT)) {
die("Failed to start SSL");
}
fwrite($fp, "USER god\r\n");
fwrite($fp, "PASS secret\r\n");
while ($motd = fgets($fp)) {
echo $motd;
}
fclose($fp);
由于我有很多遗留代码,我希望通过仅对php.ini(或CLI)应用更改来获得解决方案,但遗憾的是,以下两种方法都不起作用:
php -d verify_peer_name=false test.php
php -d …