PHP - Using cURL to access HTTPS (SSL) protected sites

Discussions of secure PHP coding. Security in software is important, so don't be afraid to ask. And when answering: be anal. Nitpick. No security vulnerability is too small.

Moderator: General Moderators

Post Reply
Ren101
Forum Newbie
Posts: 1
Joined: Tue May 01, 2012 3:39 am

PHP - Using cURL to access HTTPS (SSL) protected sites

Post by Ren101 »

The following code returns Exit code 58.

From cURL documentation:
CURLE_SSL_CERTPROBLEM (58)
problem with the local client certificate.

Code: Select all

    // create a new CURL resource
    $ch = curl_init();
    
    // set URL and other appropriate options
    curl_setopt($ch, CURLOPT_URL, $URL);
    curl_setopt($ch, CURLOPT_HEADER, false);
    
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_VERBOSE, true);
    
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
       
    curl_setopt($ch, CURLOPT_SSLCERT, getcwd() . $CERT);
    curl_setopt($ch, CURLOPT_SSLCERTPASSWD,"XXXXX");
    
    curl_setopt($ch, CURLOPT_SSLVERSION, 3);
    
    curl_setopt($ch, CURLOPT_HTTPHEADER, array(
        'Content Type: text/xml',
        'User-Agent: XXXXX',
        'User-Name: XXXXX'
    ));
    
    $RESPONSE = curl_exec($ch);  
    
    var_dump($RESPONSE);
    
    // close CURL resource, and free up system resources
    curl_close($ch);
Is there something I'm missing?
User avatar
pickle
Briney Mod
Posts: 6445
Joined: Mon Jan 19, 2004 6:11 pm
Location: 53.01N x 112.48W
Contact:

Re: PHP - Using cURL to access HTTPS (SSL) protected sites

Post by pickle »

My guess is cURL is having difficulty verifying the certificate. Try commenting out the two verification steps to see if that works. Note that this is just a test to see where the problem is - you should always verify.

If that doesn't change anything, then it's probably the next 2 lines. Make sure you're specifying the correct path to your .PEM file.
Real programmers don't comment their code. If it was hard to write, it should be hard to understand.
Post Reply