PHP: cURL SSL Verification

Torleif — Tue, 07 Dec 2010 17:04:12 +0000

While trying to figure out of PayPal Payment Data Transfers I came over an issue that caused my cURL requests to fail.

These were the cURL options I used:

curl_setopt_array($request, array
(
CURLOPT_URL => 'https://www.sandbox.paypal.com/cgi-bin/webscr',
CURLOPT_POST => TRUE,
CURLOPT_POSTFIELDS => http_build_query(array
(
'cmd' => '_notify-synch',
'tx' => $tx,
'at' => $your_pdt_identity_token,
)),
CURLOPT_RETURNTRANSFER => TRUE,
CURLOPT_HEADER => FALSE
));

It worked great on my web host, but on my local machine I could not get any response. I just got an error saying something about the certificate failing to be verified or something like that (don’t remember the exact message). After some research I found out the problem.

Since we are using the HTTPS protocol here we need to somehow verify the one we are talking to. Your browser does this by checking their certificate against several built-in certificates from trusted certificate suppliers, like for example Verisign. cURL does this verification automatically as well, except on my local machine it didn’t have any certificates to check against! Not sure why… but it didn’t. So, I had to find a collection of certificates on my own and tell cURL to use that instead of the non-existing one.

I found a collection like that at curl.haxx.se/docs/caextract.html, a so called CA bundle. Think that’s the one used by Mozilla based browsers, like FireFox, or something like that. Just download that file and stick it somewhere your PHP script can access it. Then we need to tell cURL to use it by adding two cURL options.

curl_setopt_array($request, array
(
CURLOPT_URL => 'https://www.sandbox.paypal.com/cgi-bin/webscr',
CURLOPT_POST => TRUE,
CURLOPT_POSTFIELDS => http_build_query(array
(
'cmd' => '_notify-synch',
'tx' => $transaction_id,
'at' => $pdt_identity_token,
)),
CURLOPT_RETURNTRANSFER => TRUE,
CURLOPT_HEADER => FALSE,
CURLOPT_SSL_VERIFYPEER => TRUE, // Verify peers
CURLOPT_CAINFO => 'cacert.pem' // Path to file with certificates
));

Voila!

C#: How to send emails

Torleif — Sun, 16 May 2010 00:21:02 +0000

Sending a basic email message in a C# application is quite easy thanks to a class called SmptClient. We simply need an address to send to, an address to send from, the message we want to send and the address of an SMTP server, hand it all to the SMTP client, and you’re done:

That was pretty simple, wasn’t it? But what if we need to authenticate with our server? And what if we want to send our message in a more secure manner?

Authentication

You will quite often find that an SMTP server requires you to authenticate yourself before it will let you do anything. This is however very simple to do. All we need, is to provide our credentials to the client:

var client = new SmtpClient("smtp.example.com")
{
Credentials = new NetworkCredential
{
UserName = "me@example.com",
Password = "password",
},
};

Now, when you try to send your message like before, it should be sent without problems But what if you want to send your email securely?

Using SSL to encrypt the connection

To send emails through an encrypted connection, all you have to do is to set the EnableSSL property of the SmtpClient to true:

var client = new SmtpClient("smtp.example.com")
{
EnableSSL = true,
Credentials = new NetworkCredential
{
UserName = "me@example.com",
Password = "password",
},
};

When you now try to send your email, it will use the Secure Socket Layer to encrypt the connection. Like me, you might run into a problem though; an AuthenticationException with the following message: The remote certificate is invalid according to the validation procedure.

Imperfect certificates

After reading about how these certificates work and some more digging around I found out that the certificate of the SMTP server I use is considered invalid for two reasons: Firstly it was not issued by a trusted Certification Authority (like VeriSign or Thawte), but by my host (Dreamhost themselves. And finally there is a mismatch between the domain I’m connecting to (smtp.example.com) and the domain the certificate was issued to (mail.dreamhost.com).

Manual certificate validation

SSL has two purposes: security and authentication. And the security will actually work fine and all the traffic will be encrypted even if the authentication fails. In other words, as long as we can look at the certificate ourselves and be sure that we thrust it, we can go ahead and continue with our work.

To check the certificate ourselves we can provide a RemoteCertificateValidationCallback delegate to a class called the ServicePointManager.

ServicePointManager.ServerCertificateValidationCallback
= OurCertificateValidation;

But how can we decide if we should trust the certificate or not? Well, I have found three ways that works nicely. Well, actually just two since the first is just to cover your eyes and let anything pass…

Pretend validation

The following implementation is a way to simply say that I don’t care:

static bool OurCertificateValidation(object s, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
return true;
}

This is of course not very good… we should at least make some effort and check if the certificate is the one we should be getting. We can for example…

Check the certificate fingerprint

Certificates have something called a fingerprint and if we know the fingerprint of the certificate we should get, then we can compare it with the fingerprint of the one we actually got.

static bool OurCertificateValidation(object s, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
return certificate.GetCertHashString()
== "6B8C79AB966D70277BA86E6F820859A2B5B8CCC0"; // SHA-1 fingerprint
}

If you don’t think this is enough, you can for example…

Check the whole certificate

If you can export the certificate to a file somehow, you can then later compare the certificate you get with the one you have stored and make sure they are equal.

static bool OurCertificateValidation(object s, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
var actualCertificate = X509Certificate.CreateFromCertFile("example.cert");
return certificate.Equals(actualCertificate);
}

I got a hold of the certificate file by sticking the following snippet inside my validation delegate, ran my code once, and then changed it back to normal again:

static bool OurCertificateValidation(object s, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
using (var file = File.Create("example.cert"))
{
var cert = certificate.Export(X509ContentType.Cert);
file.Write(cert, 0, cert.Length);
}
return false;
}

I also successfully exported it from Opera, which I use as an email client, by going to Preferences, Security, Manage Certificates, Approved and then export the one I want. This of course assumes you have have previously approved the certificate for use with Opera.

Wrap-up

That’s all for now! Found it kind of fun to get this working and thought I could share it in case someone else struggles with this. Please comment and let me know if I have misunderstood something or done a big blunder or something like that! I mostly just know that my code is working, so if you know more about how these security issues work and you know something you think i should know as well: Please share! I’d like to learn

Here is my final, complete code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

using System;
using System.Net.Mail;
using System.Net;
using System.Security.Authentication;
using System.Security.Cryptography.X509Certificates;
using System.IO;
using System.Net.Security;

namespace Geekality.SecureEmail
{
class Program
{
static bool OurCertificateValidation(object s, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
var actualCertificate = X509Certificate.CreateFromCertFile("example.com.cert");

return certificate.Equals(actualCertificate);
}

static void Main(string[] args)
{
// Register our own certificate validation
ServicePointManager.ServerCertificateValidationCallback = OurCertificateValidation;

// Message
var from = new MailAddress("me@example.com", "Me");
var to = new MailAddress("you@example.com", "Myself");

var message = new MailMessage(from, to)
{
Subject = "Greetings!",
Body = "How are you doing today?",
};

// Create client
var client = new SmtpClient("smtp.example.com")
{
EnableSsl = true,
Credentials = new NetworkCredential
{
UserName = "me@example.com",
Password = "password",
},
};

// Try to send
using (client)
{
try
{
client.Send(message);
Console.WriteLine("Message sent!");
}
catch (AuthenticationException e)
{
Console.WriteLine(e.Message);
}
catch (SmtpException e)
{
Console.WriteLine(e.Message);
}
}

Console.ReadKey(true);
}
}
}

Geekality » SSL