Code does not work without disabling SSL

Question

Please take a look at this code:

<?php
$url = "the_source_url";  
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
$result = curl_exec($ch);
print_r($result);
?>

This page is accessed by my Android app to get a date from some source. The url returns a json data, which I print back, then, in my app, I process the data and display it. This is working fine for me right now (I'm still in the testing phase).

I read in SO that disabling the SSL (whih I did in line 6) is risky and not recommended. However, I couldn't make my script work unless I disable it.

How to make it work without disabling the SSL? Or how to eliminate the risk?

Baba · Accepted Answer · 2013-05-04 12:26:52Z

2

Disabling the certificate would make you vulnerable to man in the middle attack, You can download use the certificate

curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, TRUE);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt ($ch, CURLOPT_CAINFO, "PATH_TO_CERTIFICATE/cert.pem");

To get the certificate follow this guide

Then click on “View Certificate”:

enter image description here

Bring up the “Details” tab of the cerficates page, and select the certificate at the top of the hierarchy. This is the CA certificate.

enter image description here

Then click “Export”, and save the CA certificate to your selected location, making sure to select the X.509 Certificate (PEM) as the save type/format.

enter image description here

Image Source : http://unitstep.net/

edited May 4, 2013 at 12:26

answered May 4, 2013 at 12:14

Baba

95.3k29 gold badges172 silver badges222 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

iTurki Over a year ago

I'm using Google Places API. I couldn't find a certificate for it!

Baba Over a year ago

Download the certificate then use it ..

hek2mgl · Accepted Answer · 2013-05-04 12:22:21Z

0

You need to add the option CURLOPT_SSL_VERIFYHOST and set it to false:

curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, FALSE);

This disables SSL host verification so that you can access a host which uses a self-signed certificate. If the host has a valid certificate then check @Baba's answer

Security considerations:

The connection is encrypted and can't being sniffed that easy. But you can not make sure that the the server is the server. So a hacker could sniff traffic using a man in the middle attack. If you want to get sure you'll have to go @Babas way and import the certificate from the server

edited May 4, 2013 at 12:22

answered May 4, 2013 at 12:10

hek2mgl

159k31 gold badges263 silver badges280 bronze badges

3 Comments

iTurki Over a year ago

This would do what exactly?

hek2mgl Over a year ago

Disables SSL host verification so that you can access a host which hasn't a signed certificate. Refer to the manual, I've linked it

iTurki Over a year ago

Isn't that what CURLOPT_SSL_VERIFYPEER does? Which I believe is not safe in terms of security?

Collectives™ on Stack Overflow

Code does not work without disabling SSL

2 Answers 2

2 Comments

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related