Repository navigation
Failed to access a TLS server #54
Description
Trying to access TLS servers, I keep getting errors. For example when trying to access https://www.google.com , I get this:
An error occurred in the underlying stream:
Unable to complete SSL/TLS handshake:
stream_socket_enable_crypto():
Peer certificate CN=`www.google.com' did not match expected CN=`74.125.140.106'
My code is:
$request = $this->client->request('GET', 'https://www.google.com', [ ]);
$request->on('error', function ($err) use ($callback) { $callback($err, NULL); });
$request->on('response', function ($response) {
$response->on('data', function ($data, $response) {
echo "Got response data";
var_dump([$data, $response]);
});
});
$request->end();
Activity
WyriHaximus commentedon Mar 13, 2016
This looks oddly familiair, what PHP version and what react/http-client version are you using?
clue commentedon Mar 14, 2016
This is a known issue that has been fixed with reactphp-legacy/socket-client#61 (occurs with any version of PHP 5.6+). We have yet to tag a new release and update this component to use the new dependency.
guss77 commentedon Mar 14, 2016
I'm using PHP 5.6, but I'm wandering if it will work with php 5.5 ?
guss77 commentedon Mar 14, 2016
Requiring
react/socket-client=dev-mastersolved the problem for me.clue commentedon Mar 14, 2016
PHP < 5.6 defaults to
verify_peer = false, which means that it should work fine with either version of socket-client.PHP >= 5.6 defaults to
verify_peer = trueand the required SSL context options are only set with the (future) v0.5 socket-client.Thanks for verifying and reporting back! I guess it makes sense to keep this ticket open until a new tag has been released 👍
WyriHaximus commentedon Mar 14, 2016
Sounds like a solid plan to me 👍
guss77 commentedon Mar 15, 2016
I've tested on PHP 5.5, and something weird is happening - with either the default socket-client as well as dev-master:
I'm trying to access a server behind a Cloudflare proxy, and when I try using PHP 5.6, everything works fine (assuming socket-client=dev-master). Under PHP 5.5 though (both socket-client versions), I get a 403 Forbidden error, with an HTML page that contains this text:
Error
Ray ID: 28433ad97dec265a * 2016-03-15 21:58:58 UTC
HTTP hostname and TLS SNI hostname mismatch
You've requested an IP address that is part of the CloudFlare network. The request's Host header does not match the request's TLS SNI Host header.
clue commentedon Mar 16, 2016
Thanks for the report @guss77!
SSL/TLS support in older version of PHP has always been flaky, so as a rule of thumb, using the latest supported version if generally a good idea :)
In this particular case, I suppose we need some more information before we can track this down, such as exact PHP version, OpenSSL version, composer package versions and a minimal test script to reproduce this issue.
For example, support for SNI was […] added in 5.3.2 and requires PHP to be built with OpenSSL 0.9.8j or greater (http://php.net/manual/en/openssl.constsni.php).
I hope this helps pinpoint any issues 👍