0 
$certFile = 'ful_path/yourcert.pem';

$context = stream_context_create();

$result = stream_context_set_option($context, 'ssl', 'local_cert',
$certFile);

$result = stream_context_set_option($context, 'ssl', 'verify_peer',
false);

$result = stream_context_set_option($context, 'ssl', 'verify_host',
false);

$result = stream_context_set_option($context, 'ssl',
'allow_self_signed', true);


$sock = stream_socket_client('tls://www.somewhere.com:9999',
$errno,$errstr, 30, STREAM_CLIENT_CONNECT, $context);

已添加：www.somewhere.com ca 到服务器证书已删除 &$ 已检查 yourcert.pem 到期时间，但未将整个代码迁移到 curl，我被卡住了。它必须是像我脸上的鼻子一样明显的东西……但是什么……

4

1 回答 1

2

First, let me say this:

PHP5.6 defaults to using CA certificate stores managed by your operating system. Unless you're connecting to a DNS name that exposes a self-signed certificate or something you probably don't need an SSL context at all.

Before you do anything else, try connecting without any ssl context. If the remote site's certificate is valid and was signed by any standard certificate authority it should "just work" automagically in PHP 5.6.

That said ... there are several very questionable things in your code snippet. It's really impossible to know which is the real problem without knowing more about what you're trying to do, so I'll just iterate over all of it.

$result = stream_context_set_option($context, 'ssl', 'local_cert',
$certFile);

^ Are you connecting to a site that requires YOU to provide a certificate that the remote server verifies? If not (and this is almost certainly the case), you should not be specifying the "local_cert" option.

$result = stream_context_set_option($context, 'ssl', 'verify_peer',
false);

^ This is a terrible idea as it exposes you to Man-in-the-Middle attacks. You should never do this unless you're testing something in a one-off scenario. DO NOT DO THIS.

$result = stream_context_set_option($context, 'ssl', 'verify_host',
false);

^ This is not even a thing. There's no "verify_host" option in PHP.

$result = stream_context_set_option($context, 'ssl',
'allow_self_signed', true);

So ... in summary there's no good way to answer this with the information you've provided. But I've pointed out the obvious issues ...

于 2015-02-14T21:40:57.373 回答