OpenSSL and cURL update?

[mo3chin3]

Hey guys, first off thank you for you work on this project it has helped me a ton! I am using Paypal's IPN and PDT for a payment confirmation and recently they updated the backend tls configuration and now those do not work. It looks like the OpenSSL and cURL are too old to continue to work with it. Is there any chance you can update those in the 5.6 release? Or provide some instruction on how to update those in the php install? I've been trying for a couple of weeks without success so I'm hoping your expertise can help out.

[mjmartin]

Yeh, agreed, TLS1.0 is going the way of the dodo, need openssl 1.0.1+ really

[fullybaked]

We've just hit this one hard too. One of our API vendors has gone TLS 1.2 only for reasons and we can't hit the endpoint from any dev box using Liip package. Ditto the thanks for this great package, but really need TLS 1.2 to continue using it.

[chregu]

We build against the openssl libraries coming with OS X. Aren't those supporting TLS 1.2 only sites?
Anyway, updating libcurl now, at least

[chregu]

Updated to latest curl. Can you please test

[fullybaked]

Nope, still no working. Assuming reinstall from curl -s http://php-osx.liip.ch/install.sh | bash -s 5.6 is the way to get the latest version

[chregu]

Do you have an example URL/code, where it doesn't work?

[fullybaked]

This was sent over by our API vendor and returns output of TLS 1.0 on all machines using the Liip package

<?php

$ch = curl_init('https://www.howsmyssl.com/a/check');

curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$data = curl_exec($ch);

curl_close($ch);



$json = json_decode($data);

echo $json->tls_version . PHP_EOL;

$curl_info = curl_version();

echo $curl_info['ssl_version'];

?>

Also using the latest CakePHP 3.x built in Http client to send requests throws "Failed crypto" exceptions on any request to a TLS 1.2 only endpoint

[fullybaked]

Just as one other piece of info (helpful or not) I just installed PHP56 from Homebrew and this dones't have the same issues.

Output from the above script is

TLS 1.2
SecureTransfer

and the CakePHP client works.

[chregu]

Yes, realized that now too. Let's see how I can compile curl against SecureTransport instead of openssl.

[chregu]

Ok, done. Can you please try again. It seems to work on my side now

[fullybaked]

Ok, the test script from the vendor now has TLS 1.2 as output but it seems that TLS 1.2 is still not registered as a stream socket transport

php -i | grep ssl

Liip

Registered Stream Socket Transports => tcp, udp, unix, udg, ssl, sslv3, sslv2, tls, tlsv1.0

Homebrew

Registered Stream Socket Transports => tcp, udp, unix, udg, ssl, sslv3, sslv2, tls, tlsv1.0, tlsv1.1, tlsv1.2

This means that while the basics are working, there still seems to be an issue when using fopen with stream contexts.

[chregu]

argh, you're example was using curl, not fopen, so i didn't check that before I compiled everything new again.. But it looks like that definitely needs an updated openssl library, not sure when I want to dig into that rabbithole

[fullybaked]

Damn. Sorry. I should have been more clear on the framework side of the original post, :/

Ok. Thanks for your time today.

[lphilps]

I too have benefited greatly from the PHP 5.6 version of this package. So, first off, many thanks to the creators/maintainers!

This issue is now impacting me too as a new third party web service I need to use is also insisting on TLS v1.2. So, I spent a bit of time poking around and found:

• The openssl version included with El Capitan‎ is OpenSSL 0.9.8zg, which is not what we all want/need. If you run openssl ciphers, you won't see anything terribly modern. :-(
• I installed the latest version of openssl via homebrew, v1.0.2f, and the openssl ciphers output it produces does list all the protocols we want.
• I used the test php script provided above by @fullybaked and ran it with Apple's El Capitan‎ PHP v5.5 and it came up with TLS 1.2: SecureTransport - it seems to support the right transports.
• So, I ran "/usr/bin/php -i" as well to look at the compile line for that version of PHP to see how Apple configured/built it and found it included this directive: --with-openssl=/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.11.Internal.sdk/usr/local

Now the directory MacOSX10.11.Internal.sdk doesn't appear to ship with XCode :-/, but it's interesting that you can specify the openssl directory in the --with-openssl parameter. :-)

So ... hypothetically, if we installed the current version of openssl from (for example) homebrew (1.0.2f) and then built php using:

--with-openssl=/usr/local/opt/openssl/lib

... maybe that would do it? I don't have time to attempt a build today, but hope to give it a shot tonight. Nevertheless, I thought I would share what I'd found so far.

[chregu]

The latest packages from php-osx.liip.ch support TLS 1.2 in curl and the test script above should return the right thing. That problem is solved. The problem @fullybaked has is that fopen doesn't support TLS 1.2, neither in Apples PHP

 /usr/bin/php -i  | grep "Registered Stream Socket Transports "
Registered Stream Socket Transports => tcp, udp, unix, udg, ssl, sslv3, sslv2, tls

nor in ours

$ /usr/local/php5/bin/php -i  | grep "Registered Stream Socket Transports "
Registered Stream Socket Transports => tcp, udp, unix, udg, ssl, sslv3, sslv2, tls, tlsv1.0

I can try to compile the latest openssl. That alone is not too hard, I'm more "scared" of dependencies in apache or other apache modules which maybe use the built in openssl library.

Will have a look, but can't promise when