Secure HTTPS Handling in PHP with cURL

Introduction

cURL is a powerful library in PHP for making HTTP requests, widely used for fetching web pages, APIs, and other resources. However, when dealing with HTTPS URLs, additional configuration is often required to handle SSL/TLS certificates properly. This article addresses a common problem where cURL fails to retrieve content from HTTPS sites due to certificate verification issues.

The HTTPS Challenge in PHP cURL

By default, cURL attempts to verify the SSL certificate of the server when making HTTPS requests. If the certificate cannot be verified against a trusted Certificate Authority (CA), the request may fail. This is a security feature to prevent man-in-the-middle attacks, but it can cause issues if the CA certificates are not properly configured on the server.

The Quick but Insecure Fix

A common quick fix is to disable SSL verification by setting CURLOPT_SSL_VERIFYPEER to false. While this allows the request to proceed, it disables all certificate checks, making the connection vulnerable to attacks. For example, an attacker could intercept the communication without detection.

// Insecure option
CURLOPT_SSL_VERIFYPEER => false

This approach is not recommended for production environments due to security risks.

The Secure Approach: Verifying SSL Certificates

To handle HTTPS securely, it is essential to ensure that cURL can verify the server's certificate. This can be achieved by providing a path to a CA certificate bundle. The cURL website offers an up-to-date bundle that can be downloaded and configured.

In PHP, you can set the CA bundle path using CURLOPT_CAINFO or by configuring the curl.cainfo directive in php.ini. This ensures that cURL uses a trusted set of CAs to validate certificates.

Implementing a Secure cURL Function

Based on the original get_web_page function, we can create a secure version that includes proper SSL verification. Below is an improved function that sets CURLOPT_SSL_VERIFYPEER to true and optionally specifies a CA bundle path.

/**
 * Get a web file from a URL securely, with SSL verification.
 * Returns an array containing response details.
 */
function get_web_page_secure($url, $caBundlePath = null)
{
    $options = array(
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HEADER => false,
        CURLOPT_FOLLOWLOCATION => true,
        CURLOPT_ENCODING => "",
        CURLOPT_USERAGENT => "spider",
        CURLOPT_AUTOREFERER => true,
        CURLOPT_CONNECTTIMEOUT => 120,
        CURLOPT_TIMEOUT => 120,
        CURLOPT_MAXREDIRS => 10,
        CURLOPT_SSL_VERIFYPEER => true,
        CURLOPT_SSL_VERIFYHOST => 2
    );

    if ($caBundlePath !== null) {
        $options[CURLOPT_CAINFO] = $caBundlePath;
    }

    $ch = curl_init($url);
    curl_setopt_array($ch, $options);
    $content = curl_exec($ch);
    $err = curl_errno($ch);
    $errmsg = curl_error($ch);
    $header = curl_getinfo($ch);
    curl_close($ch);

    $header['errno'] = $err;
    $header['errmsg'] = $errmsg;
    $header['content'] = $content;
    return $header;
}

This function allows optional specification of a CA bundle path. If not provided, cURL will use the system's default certificates.

Additional Considerations

Other cURL options, such as timeouts and user agents, are included for robustness. For more advanced features, like cookie handling or authentication, consider using object-oriented wrappers like the mycurl class from the reference article.

Conclusion

Handling HTTPS in PHP cURL requires careful attention to SSL certificate verification. Disabling verification is a security risk and should be avoided. Instead, ensure that CA certificates are properly configured to maintain secure communications. The provided code examples demonstrate how to implement these practices effectively.