4

我有一个可以从 https-connections 获取证书的 php 函数，是否可以将其扩展为也可以在 smtp-starttls 上使用？

我可以将它打开为“tcp://”，然后在发送“STARTTLS”命令后，将其切换为“ssl://”吗？

function ssl_fetch_cert($domain, $port = 443)
{
    $url = "ssl://{$domain}:{$port}";
    $connection_context_option['ssl']['capture_peer_cert'] = TRUE;
    $connection_context = stream_context_create($connection_context_option);
    $connection_client = stream_socket_client($url, $errno, $errstr, 30, STREAM_CLIENT_CONNECT, $connection_context);
    $connection_info = stream_context_get_params($connection_client);
    // $sha256 = openssl_x509_fingerprint($connection_info['options']['ssl']['peer_certificate'], 'sha256');
    return $connection_info['options']['ssl']['peer_certificate'];
}
4

1 回答 1

3

函数 stream_socket_enable_crypto() 很有用。

$url = "tcp://{$domain}:{$port}";
$connection_client = stream_socket_client($url, $errno, $errstr, 30, STREAM_CLIENT_CONNECT, $connection_context);
// timeout fread after 2s
stream_set_timeout($connection_client, 2);
// let the server introduce it self before sending command
fread($connection_client, 10240);
// send STARTTLS command
fwrite($connection_client, "STARTTLS\n");
// wait for server to say its ready, before switching
fread($connection_client, 10240);
// Switching to SSL/TLS
stream_socket_enable_crypto($connection_client, TRUE, STREAM_CRYPTO_METHOD_SSLv23_CLIENT);

https://github.com/puggan/tlsa_validation_php/blob/master/functions.php#L111

于 2015-11-15T13:32:57.553 回答