10

I'm trying to create a socket server using stream_socket_server().

Normal connections work fine, but I want to make a server that encrypts the connection without a certificate. I know that this can be accomplished with the ADH cipher, and yes, I know it's theoretically less secure than with a certificate...

The reason I'm making this server in the first place is to mock a different server to which a client connects to (over this protocol, if you're wondering).

The client is configured to ask for a certificate first, and fallback to ADH - I've tested it with the real thing, and it connects without problems, so the problem is with the socket server.

Everything I've tried so far has resulted in a "handshake failure" error.

Some of the configurations I've tried:

<?php
$server = stream_socket_server(
        "tls://127.0.0.1:6667",
        $errorno,
        $errstr,
        STREAM_SERVER_BIND | STREAM_SERVER_LISTEN,
        stream_context_create(
            array('ssl' => array('ciphers' => 'ADH'))
        )
    );
?>

<?php
$server = stream_socket_server(
        "tls://127.0.0.1:6667",
        $errorno,
        $errstr,
        STREAM_SERVER_BIND | STREAM_SERVER_LISTEN,
        stream_context_create(
            array('ssl' => array('ciphers' => '-COMPLEMENTOFALL ADH'))
        )
    );
?>

I've also tried to adjust the client to unconditionally use ADH (as with the second example above), just for testing's sake, but that too fails.

This happens with every PHP version I've tried, the latest of which is 5.5.0.

Any ideas?

4

2 回答 2

5

I would use a tool like Wireshark to examine the bits going over the wire so I could determine exactly what is going wrong with the handshake. Without that ability, you are going to be flying (or debugging) blind.

Once you know what is going wrong with your handshake, you can figure out the "why".

于 2013-08-20T16:00:30.570 回答
1

首先检查您的服务器中的 SSL 设置是否正确？在服务上运行 SSL Scanner。我有一个根本不起作用的测试脚本，因为 OpenSSL 调用在没有密钥文件的情况下无法运行。这不是答案，但我没有时间进行更多调查......

您知道 ADH 是一种弱加密吗？~ 大多数安全建议都建议将其关闭。关于 ADH 的一般阅读http://wiki.openssl.org/index.php/Manual:Ciphers(1)

于 2013-08-31T05:38:21.310 回答