Monday 15 June 2015

php - Bypassing SSL check -


I am debugging an issue that someone has access to the payment gateway using a PHP plugin. After clicking on the checkout button, it is able to avoid a 404 error, which is setting CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST to 0. I know this is bad, but does anyone know why this might be? It seems that the web site's SSL certificate of payment is being trusted ... can it be a problem with its server, which can not trust some SSL certificates?

Edit: So I have seen many solutions which are then asked to add something similar to my curl lines, when the response from the curl_exec () function is false only. Getting certificate file:

curl_setopt ($ CH, CURLOPT_CAINFO, getcwd (). "/CAtsert/certificate.cert");

But if I have a bunch of different customers this problem? That path will not work for everyone, what can I change in the place that will apply to every person?

If I can not enter a normal line, then where will I tell that person to my certificate file? It should be done by their web hosting service, okay?

Here's a good answer for you:

I pay by the payment website Suggesting the certificate to be analyzed ..
The URL used by the PHP plugin is actually the same as specified in the Common Name field of the certificate?

If you are certain that the certificate has been given, and it is reliable, then you can set the CURLOPT_CAINFO option to trust this certificate and avoid the error: curl_setopt ($ ch, CURLOPT_CAINFO , 'C: \ path \ to \ curl-ca-Bundle.crt');

No comments:

Post a Comment