为PHP 5.4.4 SoapClient启用SSLv3支持

Question

With this code:

$soap = new SoapClient('https://test-api.geotrust.com/webtrust/query.jws?WSDL');

I am seeing this error:

PHP Fatal error: SOAP-ERROR: Parsing WSDL: Couldn't load from ' https://test-api.geotrust.com/webtrust/query.jws?WSDL ' : failed to load external entity " https://test-api.geotrust.com/webtrust/query.jws?WSDL "

If you have PHP 5.5, you can do this:

$soap = new SoapClient($url),
array (
"ssl_method" => "SOAP_SSL_METHOD_SSLv23"
)

Any such solution for PHP 5.4.4? I cannot upgrade PHP at this time.

I've already tried the sslv3:// suggestion I found online, but it doesn't work on Debian.

Thanks.

Answer 1

SoapClient::SoapClient(): SSL operation failed with code 1. OpenSSL Error messages: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol

It sounds like you don't have an SSL/TLS server listening. You can reproduce it with the following. Note the use of port 80 rather than 443.

$ openssl s_client -connect stackoverflow.com:80
CONNECTED(00000003)
140735323054556:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:787:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 320 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---

---

If you do have an SSL/TLS server listening, then you can try to connect to it using a single protocol:

SSL v3 :

openssl s_client -ssl3 -connect example.com:443

TLS 1.0 :

openssl s_client -tls1 -connect example.com:443 -servername example.com

TLS 1.1 :

openssl s_client -tls1_1 -connect example.com:443 -servername example.com

TLS 1.2 :

openssl s_client -tls1_2 -connect example.com:443 -servername example.com

---

 array ( "ssl_method" => "SOAP_SSL_METHOD_SSLv23" ) 

Just bike shedding, but in C we usually use the 2/3 method and then disable useless protocols and options. For example:

const SSL_METHOD* method = SSLv23_method();
if(method == NULL) handleFailure();

SSL_CTX* ctx = SSL_CTX_new(method);
if(ctx == NULL) handleFailure();

/* Cannot fail ??? */
const long flags = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_COMPRESSION;
SSL_CTX_set_options(ctx, flags);

In the code above, we use the 2/3 method, and then we disable SSLv2 (broken), SSLv3 (weak/wounded) and Compression (broken, leaks information). That means we use TLS 1.0 and above for the connection. If TLS 1.2 is available, then its used; else if TLS 1.1 is available, then its used; else TLS 1.0 is used.