Cannot connect to HTTPS site using cURL. Instead, returns 0 length. What can I do?

Question

I have a website that connects using cURL (latest version) to a secure gateway for payment.

Problem: cURL always returns 0 the length of the content. I only get headers. And only when I set cURL to return headers. I have the following flags.

curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_ANY); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); curl_setopt($ch, CURLOPT_URL, $gatewayURI); curl_setopt($ch, CURLOPT_HEADER, 1); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt ($ch, CURLOPT_POST, 1); 

Return header

 HTTP/1.1 100 Continue HTTP/1.1 200 OK Date: Tue, 25 Nov 2008 01:08:34 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Length: 0 Content-Type: text/html Set-Cookie: ASPSESSIONIDxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx; path=/ Cache-control: private 

I also tried cURL'ing on different sites and they returned the content in order. I think the problem may have something to do with the https connection.

I talked to the company and they are useless.

Has anyone else experienced this error and know what to do? Should I pipe cURL and try to use fsockopen() ?

Thank.:)

Answer 1

You should also try checking for error messages in curl_error (). You may need to do this once after each curl_ * function.

http://www.php.net/curl_error

Answer 2

I had the same problem today. Curl comes with an obsolete file for authenticating HTTPS certificates.

get a new one:

http://curl.haxx.se/ca/cacert.pem

save it in any directory on your site

and add

 curl_setopt ($curl_ch, CURLOPT_CAINFO, dirname(__FILE__)."/cacert.pem"); 

To each request :-)

IGNORE any comments about disabling CURLOPT_VERIFYPEER and CURLOPT_VERIFYHOST! This leaves your code vulnerable to humans in medium attacks!

December 2016:

Solve this correctly using the Jasen method mentioned below.

add curl.cainfo=/etc/ssl/certs/ca-certificates.crt to you php.ini

October 2017 change:

Now there is a composite package that helps you manage ca certificates so that you are not vulnerable if your cacert.pem is out of date due to certificate revocation.

https://github.com/paragonie/certainty → composer require paragonie/certainty:dev-master

Answer 3

Note. This is strictly not a production use. If you want to debug quickly, this can be useful. Otherwise, please use @SchizoDuckie's answer above.

 curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2); 

Just add them. It is working.

Answer 4

I had a very similar problem and it was resolved by adding

 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); 

Apparently, the site I'm redirecting redirects to another location and php-curl does not redirect by default.

Answer 5

I had a situation where this helped: (PHP 5.4.16 on Windows)

 curl_setopt($ch, CURLOPT_SSLVERSION, 3); 

Answer 6

Whenever I test something with PHP / Curl, I first try to use it from the command line, find out what works, and then transfer my parameters to PHP.

Answer 7

Sometimes you need to update your Curl certificates to the latest version so as not to have errors with https.

Answer 8

I used file_get_contents with stream_create_context and it works fine:

 $postdataStr = http_build_query($postdataArr); $context_options = array ( 'http' => array ( <blink> // this will allways be http!!!</blink> 'method' => 'POST', 'header'=> "Content-type: application/x-www-form-urlencoded\r\n" . "Content-Length: " . strlen($postdataArr) . "\r\n" . "Cookie: " . $cookies."\r\n" 'content' => $postdataStr ) ); $context = stream_context_create($context_options); $HTTPSReq = file_get_contents('https://www.example.com/', false, $context); 

Answer 9

There may be a problem in your web hosting company where you are testing secure communications for the gateway that they may not allow you to do this.

there may also be a username, password that must be provided before connecting to the remote host.

or your IP may need to be on the list of approved IP addresses for the remote messaging server.

Answer 10

I found this error in a recent application project. I wrote to run from the command line or browser window, so I used server discovery to get the relative URL of the document I requested. The problem was that the site has https, and every time I tried to access http: // (the same server, cURL helped change it to https.

This works fine in the browser, but from the command line I get an SSL error, even if both options are set to false. I had to do

1) Check $ _SERVER ['HTTP_HOST']. If present, use ($ _SERVER ['HTTPS']? "Https: //": "http: //"). $ _ SERVER ['HTTP_HOST']

2) Check $ _SERVER ['COMPUTERNAME'], and if it matches the production server, provide the https URL. (" https: // (servername) ")

3) If no condition has passed, this means that I run the command line on another server and use " http: // localhost ".

Now it worked, but it hack. In addition, I never found out why on one server (https) cURL changed my URL, and on the other (also https) it left my URL alone.

Weird

Answer 11

The best way to use https and avoid security issues is to use Firefox (or another tool) and upload the certificate to your server. This web page helped me a lot , and these were the steps that worked for me:

1) Open in Firefox the URL you are going to use with CURL

2) In the address bar, click padlock > more information (FF versions may have different menus, just find them). Go to View certificate > Details tab.

3) Highlight the "correct" certificate in the Certificate hierarchy . In my case, it was the second of three, called "cPanel, Inc. Certification Authority." I just found the right trial and error method.

4) Click the Export button. In my case, the one who worked was the "PEM with circuits" file type (again, trial and error).

5) Then in your PHP script add:

 curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2); curl_setopt($ch, CURLOPT_CAINFO, [PATH_TO_CRT_FILE]); 

In addition, I would say that we should pay attention to the fact that these steps will probably need to be redone once a year or when replacing or updating the URL certificate.

Answer 12

You use the POST method, but do you provide an array of data? For example.

 curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_POSTFIELDS, $data);