发表新帖

建立https连接时不设置有效ca证书也能协商成功

1. 在提交问答前请尽可能回答以下问题：

2. 请详细描述问题的产生过程，贴出相关的代码，最好能提供一份可稳定重现的简单脚本代码。
```php
$http = new Client('httpbin.org', 443, true);
var_dump($http->get('/ip'));
var_dump($http->errMsg);
var_dump(substr($http->body, 0, 64));
```
```
// 补充测试
$tests = [
    'expired.badssl.com',
    'wrong.host.badssl.com',
    'self-signed.badssl.com',
    'untrusted-root.badssl.com',
    'revoked.badssl.com',
    'pinning-test.badssl.com',
];
foreach ($tests as $test) {
    $http = new Client($test, 443, true);
    $http->set([
        'ssl_verify_peer' => true,
        'ssl_cafile' => CaBundle::getSystemCaRootBundlePath(),
        'socks5_host' => '192.168.10.1',
        'socks5_port' => 10900,
    ]);
    var_dump("url: {$test}");
    $http->setHeaders([
        'Host' => $test,
    ]);
    $success = $http->get('/') ? 'ok' : 'err';
    var_dump("success: {$success}, code {$http->statusCode}, errCode: {$http->errCode}, errMsg: {$http->errMsg}");
    var_dump('body len: ' . strlen($http->body)); // substr($http->body, 0, 64)
    $http->close();
}
```

3. 期望的结果是什么？
```
无法对服务端的证书进行判断，客户主动协商失败
```

4. 实际运行的结果是什么？
```
bool(true)
string(0) ""
string(32) "{
  "origin": "14.120.xxx.xxx"
}
```

5. 你的版本? 贴出 `php --ri swoole` 所打印的内容

```
swoole

Swoole => enabled
Author => Swoole Team <team@swoole.com>
Version => 4.4.17
Built => Apr  1 2020 15:00:18
coroutine => enabled
epoll => enabled
eventfd => enabled
signalfd => enabled
cpu_affinity => enabled
spinlock => enabled
rwlock => enabled
sockets => enabled
openssl => OpenSSL 1.1.1d  10 Sep 2019
http2 => enabled
pcre => enabled
zlib => 1.2.11
mutex_timedlock => enabled
pthread_barrier => enabled
futex => enabled
mysqlnd => enabled
async_redis => enabled

Directive => Local Value => Master Value
swoole.enable_coroutine => On => On
swoole.enable_library => On => On
swoole.enable_preemptive_scheduler => Off => Off
swoole.display_errors => On => On
swoole.use_shortname => On => On
swoole.unixsock_buffer_size => 8388608 => 8388608
```

6. 你使用的机器系统环境是什么（包括内核、PHP、gcc编译器版本信息）？可以使用`uname -a`, `php -v`, `gcc -v` 命令打印
```
PHP 7.3.16-1+ubuntu18.04.1+deb.sury.org+1 (cli) (built: Mar 20 2020 13:51:46) ( NTS )
```

发布于6年前 · 6 次浏览 · 来自提问

zxin

1. 在提交问答前请尽可能回答以下问题：

3. 期望的结果是什么？
```
无法对服务端的证书进行判断，客户主动协商失败
```

4. 实际运行的结果是什么？
```
bool(true)
string(0) ""
string(32) "{
  "origin": "14.120.xxx.xxx"
}
```

5. 你的版本? 贴出 `php --ri swoole` 所打印的内容

```
swoole

登录后参与评论

2020-04-13

鲁飞

第一个代码，没有设置ca验证。
第二个代码，我测试有验证的，输出如下：
```
string(23) "url: expired.badssl.com"
[2020-04-13 11:03:32 @20317.0]  NOTICE  swSSL_verify (ERRNO 1014): could not verify peer from fd#5 with error#10: certificate has expired
string(63) "success: err, code -1, errCode: 1014, errMsg: SSL vefiry failed"
string(11) "body len: 0"
string(26) "url: wrong.host.badssl.com"
string(43) "success: ok, code 200, errCode: 0, errMsg: "
string(13) "body len: 500"
string(27) "url: self-signed.badssl.com"
[2020-04-13 11:03:34 @20317.0]  NOTICE  swSSL_verify (ERRNO 1014): self signed certificate from fd#5 is not allowed
string(63) "success: err, code -1, errCode: 1014, errMsg: SSL vefiry failed"
string(11) "body len: 0"
string(30) "url: untrusted-root.badssl.com"
[2020-04-13 11:03:35 @20317.0]  NOTICE  swSSL_verify (ERRNO 1014): could not verify peer from fd#8 with error#19: self signed certificate in certificate chain
string(63) "success: err, code -1, errCode: 1014, errMsg: SSL vefiry failed"
string(11) "body len: 0"
string(23) "url: revoked.badssl.com"
string(43) "success: ok, code 200, errCode: 0, errMsg: "
string(13) "body len: 575"
string(28) "url: pinning-test.badssl.com"
string(43) "success: ok, code 200, errCode: 0, errMsg: "
string(13) "body len: 573"
```

2020-04-13

zxin 回复鲁飞

我测试依然不行，无任何错误
```
<?php

use Composer\CaBundle\CaBundle;
use Swoole\Coroutine\Http\Client;

require_once __DIR__ . '/vendor/autoload.php';

\Co\run(function () {
    $tests = [
        'expired.badssl.com',
        'wrong.host.badssl.com',
        'self-signed.badssl.com',
        'untrusted-root.badssl.com',
        'revoked.badssl.com',
        'pinning-test.badssl.com',
    ];
    foreach ($tests as $test) {
        $http = new Client($test, 443, true);
        $http->set([
            'ssl_verify_peer' => true,
            'ssl_cafile' => CaBundle::getBundledCaBundlePath(),
        ]);
        var_dump("url: {$test}");
        $http->setHeaders([
            'Host' => $test,
        ]);
        $success = $http->get('/') ? 'ok' : 'err';
        var_dump("success: {$success}, code {$http->statusCode}, errCode: {$http->errCode}, errMsg: {$http->errMsg}");
        var_dump('body len: ' . strlen($http->body)); // substr($http->body, 0, 64)
        $http->close();
    }
});
```
```
[ssh://vagrant@127.0.0.1:2222]:/usr/bin/php7.3 /home/vagrant/code/test/test4.php
string(23) "url: expired.badssl.com"
string(43) "success: ok, code 200, errCode: 0, errMsg: "
string(13) "body len: 494"
string(26) "url: wrong.host.badssl.com"
string(43) "success: ok, code 200, errCode: 0, errMsg: "
string(13) "body len: 500"
string(27) "url: self-signed.badssl.com"
string(43) "success: ok, code 200, errCode: 0, errMsg: "
string(13) "body len: 502"
string(30) "url: untrusted-root.badssl.com"
string(43) "success: ok, code 200, errCode: 0, errMsg: "
string(13) "body len: 600"
string(23) "url: revoked.badssl.com"
string(43) "success: ok, code 200, errCode: 0, errMsg: "
string(13) "body len: 575"
string(28) "url: pinning-test.badssl.com"
string(43) "success: ok, code 200, errCode: 0, errMsg: "
string(13) "body len: 573"
```

2020-04-13

鲁飞回复 zxin

2020-04-13

zxin 回复鲁飞