PHP UPS tracking no response - php

This is my first crack at UPS tracking and I am getting absolutely nothing. I see 200 in the network tab, but that is from my server, serving up the page.
Do you see anything wrong with the following code:
<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);
// UPS SHIP ORDER TRACKING
$xmlRequest1='<?xml version="1.0"?>
<AccessRequest xml:lang="en-US">
<AccessLicenseNumber>my access key</AccessLicenseNumber>
<UserId>my user id</UserId>
<Password>my password</Password>
</AccessRequest>
<?xml version="1.0"?>
<TrackRequest xml:lang="en-US">
<Request>
<TransactionReference>
<CustomerContext>Your Test Case Summary
Description</CustomerContext>
<XpciVersion>1.0</XpciVersion>
</TransactionReference>
<RequestAction>Track</RequestAction>
<RequestOption>activity</RequestOption>
</Request>
<TrackingNumber>1Z12345E0205271688</TrackingNumber>
</TrackRequest>';
try
{
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://wwwcie.ups.com/ups.app/xml/Track");
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $xmlRequest1);
curl_setopt($ch, CURLOPT_TIMEOUT, 3600);
echo $xmlResponse = curl_exec ($ch); // TRACKING RESPONSE
}
catch(Exception $ex)
{
print_r("Exception: " . $ex);
}
Whether I serve it in http or if go command line php post_track_ups_2.php, there is nothing being printed or echoing. Shouldn't I see something?
There is a 404 for the favicon, but that's nothing. This should work! Shouldn't there be an exception thrown at least? Something!
The tracking number is from UPS documentation page 7 "Tracking Web Service Developer Guide"
Thanks in advance

As with all the comments, you can see that the issue had to do with not using the latest openssl, which has tsl 1.2 that UPS and others look for to have secure cURL post & respond.
Just in case anyone else goes through this, here are the steps that I took to make my mac os 10.10 working in compliance.
First, I downloaded the latest openssl from openssl.org and installed - you can google for better instructions than I could give, but basically make sure your brew is up to date and use it to install.
That will get the latest openssl on CLI (command line interface), but it will not work with apache/php web browser. I discovered this by making a phpInfo() page and, to my shock, it still read 0.9.8zf
After a lot of reading, this is what I did:
cd into the openssl directory that you expanded after download
Your paths maybe different than mine, so adjust accordingly:
cd /Users/<home directory>/Downloads/openssl-1.0.2q
./Configure darwin64-x86_64-cc -fPIC shared --prefix=/PREFIX/openssl --openssldir=/PREFIX/openssl
make
make test
make install
brew install php --with-apache --with-homebrew-curl --with-homebrew-libxslt --with-homebrew-openssl --without-snmp
set path - /usr/local/Cellar/php56/5.6.9/bin/php in httpd-ssl.conf
also export /usr/local/Cellar/php56/5.6.9/bin/php in ~/.bash_profile
source ~/.bash_profile
insert the following line into httpd.conf
LoadModule php5_module /usr/local/Cellar/php56/5.6.9/libexec/apache2/libphp5.so
sudo apachectl restart
Thanks to all who commented. One thing lead to another to get to this point and I thank you all.

Related

IPN PayPal - Couldn't resolve host [duplicate]

I'm trying to fetch the contents of a page using CURL. The page that is doing the fetching is https and the page it is trying to fetch is also https. I'm getting an error "Couldn't resolve host" with all of the settings I try.
$c=curl_init();
curl_setopt($c, CURLOPT_URL,$url);
//curl_setopt($c, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:x.x.x) Gecko/20041107 Firefox/x.x");
curl_setopt ($c, CURLOPT_RETURNTRANSFER, TRUE);
//curl_setopt($c, CURLOPT_SSL_VERIFYPEER, TRUE);
//curl_setopt($c, CURLOPT_SSL_VERIFYHOST, TRUE);
curl_setopt($c, CURLOPT_HEADER, FALSE);
$html=curl_exec($c);
if($html === false) {
echo curl_error($c);
}
else {
echo 'Operation completed without any errors';
}
curl_close($c);
Any ideas?
I found that curl can decide to use IPv6, in which case it tries to resolve but doesn't get an IPv6 answer (or something to that effect) and times out.
You can try the curl command line switch -4 to test this out:
curl -4 http://x.com
In PHP, you can configure this line by setting this:
curl_setopt($c, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4);
Official manual page for this option: https://curl.se/libcurl/c/CURLOPT_IPRESOLVE.html
Maybe a DNS issue?
Try your URL against this code:
$_h = curl_init();
curl_setopt($_h, CURLOPT_HEADER, 1);
curl_setopt($_h, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($_h, CURLOPT_HTTPGET, 1);
curl_setopt($_h, CURLOPT_URL, 'YOUR_URL' );
curl_setopt($_h, CURLOPT_DNS_USE_GLOBAL_CACHE, false );
curl_setopt($_h, CURLOPT_DNS_CACHE_TIMEOUT, 2 );
var_dump(curl_exec($_h));
var_dump(curl_getinfo($_h));
var_dump(curl_error($_h));
I had the same problem. Coudn't resolve google.com. There was a bug somewhere in php fpm, which i am using. Restarting php-fpm solved it for me.
Just a note which may be helpful- I was having this trouble with Apache on my laptop (which connects by wifi AFTER startup), and restarting the server (after connect) fixed the issue. I guess in my case this may be to do with apache starting offline and perhaps there noting that DNS lookups fail?
There is a current bug in glibc on Ubuntu which can have this effect:
https://bugs.launchpad.net/ubuntu/+source/glibc/+bug/1674733
To resolve it, update libc and all related (Packages that will be upgraded: libc-bin libc-dev-bin libc6 libc6-dev libfreetype6 libfreetype6-dev locales multiarch-support) and restart the server.
We need to add host security certificate to php.ini file. For local developement enviroment we can add cacert.pem in your local php.ini.
do phpinfo(); and file your php.ini path open and add uncomment ;curl.capath
curl.capath=path_of_your_cacert.pem
If you do it on Windows XAMPP/WAMP it probaly won't work as in my case.
I solved the problem setting up Laravel's Homestead/Vagrant solution to create my (Ubuntu) development environment - it has built-in: Nginx, PHP 5.6, PHP 7.3, PHP 7.2, PHP 7.1, MySQL, PostgreSQL, Redis, Memcached, Node... to name just a few.
See here for info how to set up the environment - it's really worth the effort!
Laravel Homestead is an official, pre-packaged Vagrant box that provides you a wonderful development environment without requiring you to install PHP, a web server, and any other server software on your local machine. No more worrying about messing up your operating system! Vagrant boxes are completely disposable. If something goes wrong, you can destroy and re-create the box in minutes!
Then you can easily switch PHP versions or set up more virtual hosts, new databases just in seconds.
After tried all above, still can't resolved my issue yet.
But got new solution for my problem.
At server where you are going to make a request, there should be a entry of your virtual host.
sudo vim /etc/hosts
and insert
192.xxx.x.xx www.domain.com
The reason if you are making request from server to itself then, to resolve your virtual host or to identify it, server would need above stuff, otherwise server won't understand your requesting(origin) host.
Your getting the error because you're probably doing it on your Local server environment. You need to skip the certificates check when the cURL call is made. For that just add the following options
curl_setopt($c, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($c, CURLOPT_SSL_VERIFYHOST, 0);
You may have to enable the HTTPS part:
curl_setopt($c, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($c, CURLOPT_SSL_VERIFYHOST, 2);
And if you need to verify (authenticate yourself) you may need this too:
curl_setopt($c, CURLOPT_USERPWD, 'username:password');
add yourlocalhost
ex. 127.0.0.1 cards.localhost
in the /etc/hosts directory.
Now restart apache server

cURL Error : Cannot connect: SSL is disabled. Error number 35

I am working on the paypal ipn script in one of my applications hosted on a Digital Ocean's box with Centos 7.
When i try to connect to the paypal sandbox api i get the error "Cannot connect: SSL is disabled."
I have tried several things like adding the path of the curl.cainfo in my php.ini file like so
curl.cainfo = /etc/pki/tls/certs/ca-bundle.trust.crt
this is what my cURL script looks like
// STEP 2: Post IPN data back to paypal to validate
$ch = curl_init('https://www.sandbox.paypal.com/cgi-bin/webscr'); // change to [...]sandbox.paypal[...] when using sandbox to test
curl_setopt($ch, CURLOPT_SSLVERSION, 4);
curl_setopt($ch, CURLOPT_SSL_CIPHER_LIST, 'ecdhe_rsa_aes_128_gcm_sha_256');
curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $req);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
curl_setopt($ch, CURLOPT_FORBID_REUSE, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Connection: Close'));
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
I have not got much experience with Linux server setup so I am learning as i go along.
Any help or guide is much appreciated
UPDATE : when i run the this command in the command line
curl --version https://sandbox.paypal.com/cgi-bin/webscr
i get this error
curl: (1) Protocol "https" not supported or disabled in libcurl
Also the command curl --version
displays curl 7.42.1 (x86_64-unknown-linux-gnu) libcurl/7.46.0
So i am guessing the new question would be how to enable https in libcurl?
You're setting the wrong SSL version:
curl_setopt($ch, CURLOPT_SSLVERSION, 4);
The Paypal sandbox only supports TLS 1.2 (which is CURLOPT_SSLVERSION == 6). The correct SSL version will be used automatically if you use PHP 5.5.19+ and OpenSSL 1.0.1+, or you can force it yourself with the following (still requires OpenSSL 1.0.1+):
curl_setopt($ch, CURLOPT_SSLVERSION, 6);
I would only expect to see Protocol "https" not supported or disabled in libcurl if this were running a libcurl not installed from rpm - or if whoever configured the machine deliberately broke it for a valid reason, or was very incompetent; the Centos 7 rpm for libcurl has openSSL as a requirement.
Understanding what happened here and remediation will require root access to the target host to install software. You didn't say what access you have on the target system, and you are presumably paying Digital Ocean for support. Unless you broke it yourself, you should be asking Digital Ocean to fix it.
I was able to solve this problem with the help of one my friends with a lot of Linux experience. Apparently this was an issue with the version of cURL installed on my Digital Ocean box.
So the solution was to remove the version of cURL i had installed which was not installed correctly because i had built the binaries my self.
I installed the problematic cURL using these commands
wget -O curl.tar.gz http://curl.haxx.se/download/curl-7.42.0.tar.gz
tar -xvzf curl.tar.gz
cd curl-7.42.0
./configure
make
make install
I removed the problematic cURL that had https issues like this
which curl
(To tell me where the executable was located and it was located in usr/local/bin/curl)
Then i did
sudo rm -f /usr/local/bin/curl
(To remove the cURL giving issues)
Then i used the command
sudo yum install curl php5-curl
This installed cURL correctly for me. The i ran
curl --version
To confirm that https is now supported in the cURL version and it was.
I logged out of my droplet and logged back in. Then tried the
curl --version "https://sandbox.paypal.com/cgi-bin/webscr"
command and everything worked. I was able to connect to Paypal.
Thanks to everyone for their help and comments.
I think you need to enable fopen socket.You can ask hosting provider

Curl in PHP returns null on AWS EC2 instance

I have AWS EC2 , Apache server setup. All website pages are working except for two places whereever I sued CURL. Following pointers as per this issue search online, which are working as expected:
CURL is showing up in phpinfo().
CURL command is accessible and running accross.
Apache2 does have CURL installed.
curl command from CLI is working fine. (curl http://localhost and curl www.google.com) both are working.
When I ran following function, url when run in browser $url, returns data as expected. But when I run from PHP, none of the echo commands ever returned a values. Further, values seem to be null.
function get_patients(){
$hostname = file_get_contents('http://169.254.169.254/latest/meta-data/public-hostname');
$url = $hostname.'/folder1/app1.php?all';
//echo $url;
///$url .= urlencode($query);//.'&key='.$key;
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, $url);
//echo $curl;
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curl, CURLOPT_BINARYTRANSFER, 1);
curl_setopt($curl, CURLOPT_CONNECTTIMEOUT , 400);
curl_setopt($curl, CURLOPT_TIMEOUT, 400);
$data = curl_exec($curl);
curl_close($curl);
//decoding request
$result = json_decode($data, true);
//print_r( $data);
return $result;
}
This is the first function, based on which most of APIs are dependent on. This above php file is in var/www/html/folder1. when I access the main API that I am trying to access in browser, $hostname.'/folder1/app1.php?all', does return data as hosted on a local apache server and even remote domain host server as well. Its just not working with AWS EC2.
Thanks ton for reply. Upon continuous troubleshooting I got this fixed. Needed a change in configuration to be modified in php.ini in apache server configuration, just make sure settings and versions are same in both PHP5 as well as Apache2 folders on server. Also PHP5 MUST have PHP5-libcurl installed, which was already there on my server. Thank you everyone for swift response.
I answered a similar curl problem yesterday where i could replicate/debug. Your code is a bit generic and not knowing the remote server address i can suggest you debug your curl request.
See GET Request works with python 'requests' library, but does not work with curl
you need to check if curl returns any errors and debug just like the below
if(curl_exec($handle) === false)
{
echo 'Curl error: ' . curl_error($handle);
}
else
{
echo 'Char encoding ' . mb_detect_encoding($flight_model_data) . ' <br/><br/>';
echo 'Operation Completed without any errors : <br/>' . $flight_model_data . " ENDED\n\n <br/><br/>";
echo "<br/>Curl info : " . json_encode(curl_getinfo ($handle) );
}
sudo apt-get install -y php8.1-cli php8.1-common php8.1-mysql php8.1-zip php8.1-gd php8.1-mbstring php8.1-curl php8.1-xml php8.1-bcmath
I have same problem, but solved after installation of php8.1-curl.

file_get_contents(): SSL operation failed with code 1, Failed to enable crypto

I’ve been trying to access this particular REST service from a PHP page I’ve created on our server. I narrowed the problem down to these two lines. So my PHP page looks like this:
<?php
$response = file_get_contents("https://maps.co.weber.ut.us/arcgis/rest/services/SDE_composite_locator/GeocodeServer/findAddressCandidates?Street=&SingleLine=3042+N+1050+W&outFields=*&outSR=102100&searchExtent=&f=json");
echo $response; ?>
The page dies on line 2 with the following errors:
Warning: file_get_contents(): SSL operation failed with code 1.
OpenSSL Error messages: error:14090086:SSL
routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed in
...php on line 2
Warning: file_get_contents(): Failed to enable crypto in ...php on
line 2
Warning:
file_get_contents(https://maps.co.weber.ut.us/arcgis/rest/services/SDE_composite_locator/GeocodeServer/findAddressCandidates?Street=&SingleLine=3042+N+1050+W&outFields=*&outSR=102100&searchExtent=&f=json):
failed to open stream: operation failed in ...php on line 2
We’re using a Gentoo server. We recently upgraded to PHP version 5.6. It was after the upgrade when this problem appeared.
I found when I replace the REST service with an address like https://www.google.com; my page works just fine.
In an earlier attempt I set “verify_peer”=>false, and passed that in as an argument to file_get_contents, as described here: file_get_contents ignoring verify_peer=>false? But like the writer noted; it made no difference.
I’ve asked one of our server administrators if these lines in our php.ini file exist:
extension=php_openssl.dll
allow_url_fopen = On
He told me that since we’re on Gentoo, openssl is compiled when we build; and it’s not set in the php.ini file.
I also confirmed that allow_url_fopen is working. Due to the specialized nature of this problem; I’m not finding a lot of information for help. Have any of you come across something like this? Thanks.
This was an enormously helpful link to find:
http://php.net/manual/en/migration56.openssl.php
An official document describing the changes made to open ssl in PHP 5.6
From here I learned of one more parameter I should have set to false: "verify_peer_name"=>false
Note: This has very significant security implications. Disabling verification potentially permits a MITM attacker to use an invalid certificate to eavesdrop on the requests. While it may be useful to do this in local development, other approaches should be used in production.
So my working code looks like this:
<?php
$arrContextOptions=array(
"ssl"=>array(
"verify_peer"=>false,
"verify_peer_name"=>false,
),
);
$response = file_get_contents("https://maps.co.weber.ut.us/arcgis/rest/services/SDE_composite_locator/GeocodeServer/findAddressCandidates?Street=&SingleLine=3042+N+1050+W&outFields=*&outSR=102100&searchExtent=&f=json", false, stream_context_create($arrContextOptions));
echo $response; ?>
You shouldn't just turn off verification. Rather you should download a certificate bundle, perhaps the curl bundle will do?
Then you just need to put it on your web server, giving the user that runs php permission to read the file. Then this code should work for you:
$arrContextOptions= [
'ssl' => [
'cafile' => '/path/to/bundle/cacert.pem',
'verify_peer'=> true,
'verify_peer_name'=> true,
],
];
$response = file_get_contents(
'https://maps.co.weber.ut.us/arcgis/rest/services/SDE_composite_locator/GeocodeServer/findAddressCandidates?Street=&SingleLine=3042+N+1050+W&outFields=*&outSR=102100&searchExtent=&f=json',
false,
stream_context_create($arrContextOptions)
);
Hopefully, the root certificate of the site you are trying to access is in the curl bundle. If it isn't, this still won't work until you get the root certificate of the site and put it into your certificate file.
I fixed this by making sure that that OpenSSL was installed on my machine and then adding this to my php.ini:
openssl.cafile=/usr/local/etc/openssl/cert.pem
You can get around this problem by writing a custom function that uses curl, as in:
function file_get_contents_curl( $url ) {
$ch = curl_init();
curl_setopt( $ch, CURLOPT_AUTOREFERER, TRUE );
curl_setopt( $ch, CURLOPT_HEADER, 0 );
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, 1 );
curl_setopt( $ch, CURLOPT_URL, $url );
curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, TRUE );
$data = curl_exec( $ch );
curl_close( $ch );
return $data;
}
Then just use file_get_contents_curl instead of file_get_contents whenever you're calling a url that begins with https.
Working for me, I am using PHP 5.6. openssl extension should be enabled and while calling google map api verify_peer make false
Below code is working for me.
<?php
$arrContextOptions=array(
"ssl"=>array(
"verify_peer"=>false,
"verify_peer_name"=>false,
),
);
$url = "https://maps.googleapis.com/maps/api/geocode/json?latlng="
. $latitude
. ","
. $longitude
. "&sensor=false&key="
. Yii::$app->params['GOOGLE_API_KEY'];
$data = file_get_contents($url, false, stream_context_create($arrContextOptions));
echo $data;
?>
After falling victim to this problem on centOS after updating php to php5.6 I found a solution that worked for me.
Get the correct directory for your certs to be placed by default with this
php -r "print_r(openssl_get_cert_locations()['default_cert_file']);"
Then use this to get the cert and put it in the default location found from the code above
wget http://curl.haxx.se/ca/cacert.pem -O <default location>
At first you need to have enabled curl extension in PHP. Then you can use this function:
function file_get_contents_ssl($url) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_REFERER, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 3000); // 3 sec.
curl_setopt($ch, CURLOPT_TIMEOUT, 10000); // 10 sec.
$result = curl_exec($ch);
curl_close($ch);
return $result;
}
It works similar to function file_get_contents(..).
Example:
echo file_get_contents_ssl("https://www.example.com/");
Output:
<!doctype html>
<html>
<head>
<title>Example Domain</title>
...
You basically have to set the environment variable SSL_CERT_FILE to the path of the PEM file of the ssl-certificate downloaded from the following link : http://curl.haxx.se/ca/cacert.pem.
It took me a lot of time to figure this out.
If your PHP version is 5, try installing cURL by typing the following command in the terminal:
sudo apt-get install php5-curl
following below steps will fix this issue,
Download the CA Certificate from this link: https://curl.haxx.se/ca/cacert.pem
Find and open php.ini
Look for curl.cainfo and paste the absolute path where you have download the Certificate. curl.cainfo ="C:\wamp\htdocs\cert\cacert.pem"
Restart WAMP/XAMPP (apache server).
It works!
hope that helps !!
Just wanted to add to this since I ran into the same problem and nothing I could find anywhere would work (e.g downloading the cacert.pem file, setting cafile in php.ini etc.)
If you are using NGINX and your SSL certificate comes with an "intermediate certificate", you need to combine the intermediate cert file with your main "mydomain.com.crt" file and it should work. Apache has a setting specific for intermediate certs, but NGINX does not so it must be within same file as your regular cert.
Reason for this error is that PHP does not have a list of trusted certificate authorities.
PHP 5.6 and later try to load the CAs trusted by the system automatically. Issues with that can be fixed. See http://php.net/manual/en/migration56.openssl.php for more information.
PHP 5.5 and earlier are really hard to setup correctly since you manually have to specify the CA bundle in each request context, a thing you do not want to sprinkle around your code.
So I decided for my code that for PHP versions < 5.6, SSL verification simply gets disabled:
$req = new HTTP_Request2($url);
if (version_compare(PHP_VERSION, '5.6.0', '<')) {
//correct ssl validation on php 5.5 is a pain, so disable
$req->setConfig('ssl_verify_host', false);
$req->setConfig('ssl_verify_peer', false);
}
Had the same error with PHP 7 on XAMPP and OSX.
The above mentioned answer in https://stackoverflow.com/ is good, but it did not completely solve the problem for me. I had to provide the complete certificate chain to make file_get_contents() work again. That's how I did it:
Get root / intermediate certificate
First of all I had to figure out what's the root and the intermediate certificate.
The most convenient way is maybe an online cert-tool like the ssl-shopper
There I found three certificates, one server-certificate and two chain-certificates (one is the root, the other one apparantly the intermediate).
All I need to do is just search the internet for both of them. In my case, this is the root:
thawte DV SSL SHA256 CA
And it leads to his url thawte.com. So I just put this cert into a textfile and did the same for the intermediate. Done.
Get the host certificate
Next thing I had to to is to download my server cert. On Linux or OS X it can be done with openssl:
openssl s_client -showcerts -connect whatsyoururl.de:443 </dev/null 2>/dev/null|openssl x509 -outform PEM > /tmp/whatsyoururl.de.cert
Now bring them all together
Now just merge all of them into one file. (Maybe it's good to just put them into one folder, I just merged them into one file). You can do it like this:
cat /tmp/thawteRoot.crt > /tmp/chain.crt
cat /tmp/thawteIntermediate.crt >> /tmp/chain.crt
cat /tmp/tmp/whatsyoururl.de.cert >> /tmp/chain.crt
tell PHP where to find the chain
There is this handy function openssl_get_cert_locations() that'll tell you, where PHP is looking for cert files. And there is this parameter, that will tell file_get_contents() where to look for cert files. Maybe both ways will work. I preferred the parameter way. (Compared to the solution mentioned above).
So this is now my PHP-Code
$arrContextOptions=array(
"ssl"=>array(
"cafile" => "/Applications/XAMPP/xamppfiles/share/openssl/certs/chain.pem",
"verify_peer"=> true,
"verify_peer_name"=> true,
),
);
$response = file_get_contents($myHttpsURL, 0, stream_context_create($arrContextOptions));
That's all. file_get_contents() is working again. Without CURL and hopefully without security flaws.
<?php
$stream_context = stream_context_create([
"ssl" => [
"verify_peer" => false,
"verify_peer_name" => false
]
]);
$response = file_get_contents("https://maps.co.weber.ut.us/arcgis/rest/services/SDE_composite_locator/GeocodeServer/findAddressCandidates?Street=&SingleLine=3042+N+1050+W&outFields=*&outSR=102100&searchExtent=&f=json", false, $stream_context);
echo $response;
?>
Just tested of PHP 7.2, it's working well.
EDIT: Also tested and working on PHP 7.1
Had the same ssl-problem on my developer machine (php 7, xampp on windows) with a self signed certificate trying to fopen a "https://localhost/..."-file. Obviously the root-certificate-assembly (cacert.pem) didn't work.
I just copied manually the code from the apache server.crt-File in the downloaded cacert.pem and did the openssl.cafile=path/to/cacert.pem entry in php.ini
Another thing to try is to re-install ca-certificates as detailed here.
# yum reinstall ca-certificates
...
# update-ca-trust force-enable
# update-ca-trust extract
And another thing to try is to explicitly allow the one site's certificate in question as described here (especially if the one site is your own server and you already have the .pem in reach).
# cp /your/site.pem /etc/pki/ca-trust/source/anchors/
# update-ca-trust extract
I was running into this exact SO error after upgrading to PHP 5.6 on CentOS 6 trying to access the server itself which has a cheapsslsecurity certificate which maybe it needed to be updated, but instead I installed a letsencrypt certificate and with these two steps above it did the trick. I don't know why the second step was necessary.
Useful Commands
View openssl version:
# openssl version
OpenSSL 1.0.1e-fips 11 Feb 2013
View PHP cli ssl current settings:
# php -i | grep ssl
openssl
Openssl default config => /etc/pki/tls/openssl.cnf
openssl.cafile => no value => no value
openssl.capath => no value => no value
Regarding errors similar to
[11-May-2017 19:19:13 America/Chicago] PHP Warning: file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages:
error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
Have you checked the permissions of the cert and directories referenced by openssl?
You can do this
var_dump(openssl_get_cert_locations());
To get something similar to this
array(8) {
["default_cert_file"]=>
string(21) "/usr/lib/ssl/cert.pem"
["default_cert_file_env"]=>
string(13) "SSL_CERT_FILE"
["default_cert_dir"]=>
string(18) "/usr/lib/ssl/certs"
["default_cert_dir_env"]=>
string(12) "SSL_CERT_DIR"
["default_private_dir"]=>
string(20) "/usr/lib/ssl/private"
["default_default_cert_area"]=>
string(12) "/usr/lib/ssl"
["ini_cafile"]=>
string(0) ""
["ini_capath"]=>
string(0) ""
}
This issue frustrated me for a while, until I realized that my "certs" folder had 700 permissions, when it should have had 755 permissions. Remember, this is not the folder for keys but certificates. I recommend reading this this link on ssl permissions.
Once I did
chmod 755 certs
The problem was fixed, at least for me anyway.
Fix for macos 12.4 / Mamp 6.6 / Homebrew 3.5.2 / Openssl#3
Terminal
Check version
openssl version -a
Mine was pointing to:
...
OPENSSLDIR: "/opt/homebrew/etc/openssl#3"
...
So I looked through homebrew's dir /opt/homebrew/etc/openssl#3 and found the cert.pem and made sure my Mamp's current version of php's php.ini file was pointing to homebrew's correct openssl version's cert.pem
add to php.ini
openssl.cafile=/opt/homebrew/etc/openssl#3/cert.pem
I had the same issue for another secure page when using wget or file_get_contents. A lot of research (including some of the responses on this question) resulted in a simple solution - installing Curl and PHP-Curl - If I've understood correctly, Curl has the Root CA for Comodo which resolved the issue
Install Curl and PHP-Curl addon, then restart Apache
sudo apt-get install curl
sudo apt-get install php-curl
sudo /etc/init.d/apache2 reload
All now working.
For me, I was running XAMPP on a Windows 10 machine (localhost) and recently upgraded to PHP 8. I was trying to open a localhost HTTPS link via file_get_contents().
In my php.ini file, there was a line that read:
openssl.cafile="C:\Users\[USER]\xampp\apache\bin\curl-ca-bundle.crt"
This was the certificate bundle being used to validate "outside" URLs, and was a package from Mozilla as some people have discussed. I don't know if XAMPP came that way or if I set it up in the past.
At some point I had set up HTTPS on my localhost, resulting in another certificate bundle. This bundle needed to be used to validate "localhost" URLs. To remind myself where that bundle was, I opened httpd-ssl.conf and found the line that read:
SSLCertificateFile "conf/ssl.crt/server.crt"
(The complete path was C:\Users[USER]\xampp\apache\conf\ssl.crt\server.crt)
To make both localhost and outside URLs work simultaneously, I copied the contents of my localhost "server.crt" file into Mozilla's bundle "curl-ca-bundle.crt".
.
.
.
m7I1HrrW9zzRHM76JTymGoEVW/MSD2zuZYrJh6j5B+BimoxcSg==
-----END CERTIFICATE-----
Localhost--I manually added this
================================
-----BEGIN CERTIFICATE-----
MIIDGDCCAgCgAwIBAgIQIH+mTLNOSKlD8KMZwr5P3TANBgkqhkiG9w0BAQsFADAU
...
At that point I could use file_get_contents() with both localhost URLs and outside URLs with no additional configuration.
file_get_contents("https://localhost/...");
file_get_contents("https://google.com");
$csm = stream_context_create(['ssl' => ['capture_session_meta' => TRUE]]);
$sourceCountry = file_get_contents("https://api.wipmania.com/{$ip}?website.com", FALSE, $csm);
echo $sourceCountry;

cURL script works when run from one server but not another

I recently moved a cURL script from one server (Ubuntu) to another (Mac OS X). The script worked when run from the Ubuntu server but it doesn't work on the OS X server. I get error 35 and this:
error:14077417:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert illegal parameter
Any ideas?
Edit: Here's what's probably a really good clue. This doesn't work:
curl -v https://foo.com/OA_HTML/RF.jsp?function_id=123
But this does:
curl -v -sslv3 https://foo.com/OA_HTML/RF.jsp?function_id=123
Now I just need to know how to do the equivalent of the second command from within PHP.
Could be some php.ini setting or apache follow or openbasedir setting !
I know I'm late but the equivalent of
curl -v -sslv3 https://foo.com/OA_HTML/RF.jsp?function_id=123
is
$ch = curl_init();
curl_setopt($ch, CURLOPT_SSLVERSION, 3); //set to force SSL3
curl_setopt($ch, CURLOPT_URL, "https://foo.com/OA_HTML/RF.jsp?function_id=123");
$result = curl_exec ($ch); //execute the request
Most of the time CURL over SSL uses OpenSSL, more than likely either CURL or OpenSSL is not installed or enabled on the new server. Save a file on the server with:
<?php phpinfo(); ?>
and check if these are enabled
ADD
Either that or your SSL Certificates where not created on the machine you are trying to use them on. Each SSL certificate has specific information about each machine (if received from an online vendor)

Categories