I developed the resource to generate pdf using Lib DOMPDF in my system.
But it only works correctly when I'm in the DEV environment that uses HTTP, when I move to the Official environment that uses the SSL certificate generated by Let's Encrypt it breaks, the images and the style.css don't load.
The "src" of images and css is being passed the absolute path
I tried passing the parameters below, but it still didn't work.
$options = new Options();
$options->setChroot($projectPath);
$options->isRemoteEnabled(true);
$domPdf = new Dompdf($options);
$domPdf->setBasePath($projectPath);
$context = stream_context_create([
'ssl' => [
'allow_self_signed'=> TRUE,
'verify_peer' => FALSE,
'verify_peer_name' => FALSE,
]
]);
$domPdf->setHttpContext($context);
Related
For a customer we're making a (secured) Soap connection with a Dutch asbestos governmental API in PHP (Laravel in our case) but we are struggling with setting it up.
We've received a guide on how to create the required SSL certificate files, mailed them to the company that provides the API, tested the .wsdl file with SSL(with the .pfx file) in SoapUI and everything works perfectly.
But when we use it in PHP's SoapClient, an Exception is thrown mentioning:
"Could not connect to host"
Here's our code:
$wsdl = resource_path("wsdl/testing/portal_1_1.wsdl");
/**
* #see https://www.php.net/manual/en/soapclient.construct.php
*/
$options = [
'location' => 'https://acceptatie.tws-esb.rws.nl/lavs-koppelvlak-bacc',
'local_cert' => resource_path("certs" . DIRECTORY_SEPARATOR . "vdm-lavs.pem"),
'passphrase' => 'Pr0v!de',
'cache_wsdl' => "WSDL_CACHE_NONE",
'trace' => true,
'exceptions' => true,
'soap_version' => SOAP_1_1,
'stream_context' => stream_context_create([
'ssl' => [
'verify_peer' => false,
'verify_peer_name' => false,
],
])
];
$soapClient = new \SoapClient($wsdl, $options);
$result = $soapClient->__soapCall('statusOpvraging', []);
What I've checked so far is :
Adding allow_self_signed to the ssl configuration
Since the SoapUI uses the .pfx certificate and the local_cert in SoapClient in PHP does not work with .pfx but .pem, we tried both
We tried it in Postman as a regular HTTP call and it works fine
We've tried in an old PHP 5.6 and Laravel 5.3.0 and a new fresh PHP 8.0 with Laravel 8.68.1 configuration, both result in the same error.
Does anybody have any suggestion?
I have been trying to load a particular https wsdl via php soapclient.
The error that I am getting is:
SOAP-ERROR: Parsing WSDL: Couldn't load from 'https://xxxx.com?wsdl' : failed to load external entity "https://xxxx.com?wsdl"
Moreover I also try to "Curl https://xxxx.com?wsdl" as well. The error that I am getting is:
curl: (35) error:141A318A:SSL routines:tls_process_ske_dhe:dh key too
small
I am able to view the particular wsdl via browser. Curl with http instead of https returns the correct response.
The weird thing is that, my colleague has ubuntu 18.04 installed on his machine and he does not have any problems. For your information, I have debian 10 installed and we both have the same IP address.
I really don't understand where the issue can be.
You should try disable certificate validation when construct SoapClient instance
$context = stream_context_create([
'ssl' => [
// set some SSL/TLS specific options
'verify_peer' => false,
'verify_peer_name' => false,
'allow_self_signed' => true
]
]);
$client = new SoapClient($url, [
... ( other params )
'stream_context' => $context
]);
If you use curl from command line you can use the --insecure/-k flag.
I'm having the situation where I try to connect to a SSL host via SOAP in a Docker Application.
When trying to do so, I have to disable SSL on transport level in order to get it working. I'm using code like this:
$context = stream_context_create([
'ssl' => [
// set some SSL/TLS specific options
'verify_peer' => false,
'verify_peer_name' => false,
'allow_self_signed' => true
]
]);
$client = new SoapClient(null, [
'location' => 'https://...',
'uri' => '...',
'stream_context' => $context
]);
Which is also the most upvoted answer on this question.
So, what I'd like to achieve is to get the connection running without this hack.
If I leave this out, I receive the following exception:
( ! ) Fatal error: SOAP-ERROR: Parsing WSDL: Couldn't load from 'https://api.myhost.tld/gateway/Method?wsdl' : failed to load external entity "https://api.myhost.tld/gateway/Method?wsdl" in /var/www/html/app/code/local/Vendor/MyHost/Model/Method.php on line 31
You need trusted certificate for your domain api.myhost.tld to make it right. So you can buy "official" SSL certificate and attach that to your SOAP webserver or create self signed certificate and add that cert as trusted in your docker image like described there: How do I add a CA root certificate inside a docker image?
I browsed the net for three days and I still can not solve my problem... That's why I ask for your help :)
I try to call a web servcice over https with selfsigned certificate and i get the following error : SOAP-ERROR: Parsing WSDL: Couldn't load from 'https://...
My code :
$streamContext = stream_context_create(array(
'ssl' => array(
'verify_peer' => false,
'allow_self_signed' => true
)
));
$client = new SoapClient("https://DOMAIN/ws.php?wsdl", array(
'trace' => true,
'stream_context' => $streamContext
));
$client->method($params);
I tried to :
Change values of "verify_peer" and "allow_self_signed" options ;
Replace "ssl" key by "https" in stream_context array ;
Load the WSDL file locally but i get the following error : Could not connect to host (my endpoint : https://DOMAIN/ws.php);
Clear my client cache ;
Use Zend_Soap_Client and nusoap library.
Also, I checked the connection between the client and the server with the following commands "ping DOMAIN" and "telnet DOMAIN 443" and everything is ok.
It seems the "stream_context" option is ignored or the problem is elsewhere ?!
Is it a php Bug ?!
All suggestions will be appreciated.
Thx
I had a very similar problem and I added 'verify_peer_name' => false to the stream context. So...
$streamContext = stream_context_create(array(
'ssl' => array(
'verify_peer' => false,
'verify_peer_name' => false,
'allow_self_signed' => true
)
));
Editor's note: disabling SSL verification has security implications. Without verification of the authenticity of SSL/HTTPS connections, a malicious attacker can impersonate a trusted endpoint (such as GitHub or some other remote Git host), and you'll be vulnerable to a Man-in-the-Middle Attack. Be sure you fully understand the security issues before using this as a solution.
Summary:
Is there a way to force the built in SoapClient-class in PHP to connect over HTTPS to a server with an invalid certificate?
Why would I want to do that?
I have deployed a new application on a server that has no DNS entry or certificate yet. I want to try connecting to it with a SoapClient before setting up the DNS entry and fixing the certificate, and the most reasonable way to do this seems to be to just make the client ignore the certificate during testing.
Don't I realise that this is a huge security risk?
This is only for testing. When the service goes into production, there will be a valid certificate in place, and the client will be forced to validate it.
SoapClient takes a stream context in its parameters, which you can create yourself. That way you can control almost every aspect of the transport layer:
$context = stream_context_create([
'ssl' => [
// set some SSL/TLS specific options
'verify_peer' => false,
'verify_peer_name' => false,
'allow_self_signed' => true
]
]);
$client = new SoapClient(null, [
'location' => 'https://...',
'uri' => '...',
'stream_context' => $context
]);
Documentation:
stream_context_create() Docs
HTTP context options Docs
SSL context options Docs
The accepted answer works but only in the non-WSDL mode. If you try to use this in the WSDL mode (i. e. you pass a WSDL file url as the first argument) you will face the fact that the stream context is ignored when downloading WSDL files. So if the WSDL file is also located on a server with broken certificate, it will fail, most likely throwing the message failed to load external entity. See more here and here.
As suggested, the simplest way around is to download the WSDL file manually and pass the local copy to the SoapClient. You can download it for example with file_get_contents using the very same stream context from the accepted answer.
Note that you will also have to do this when creating a SoapServer.
The correct list for PHP 5.6.8 is
'ssl' => array('verify_peer_name'=>false, 'allow_self_signed' => true),
"verify_peer"=>false,
"verify_peer_name"=>false,
This is working on php 5.6.x;
$arrContextOptions=stream_context_create(array(
"ssl" => array(
"verify_peer" => false,
"verify_peer_name" => false,
)));
$this->client = new \SoapClient("https://tests.com?WSDL",
array(
//"soap_version" => SOAP_1_2,
"trace" => 1, // enable trace to view what is happening
"exceptions" => 0, // disable exceptions
"cache_wsdl" => 0, // disable any caching on the wsdl, encase you alter the wsdl
"stream_context" => $arrContextOptions
)
);
or if you want you can add to cyrpto method
$arrContextOptions=stream_context_create(array(
"ssl"=>array(
"verify_peer"=>false,
"verify_peer_name"=>false,
'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT
));