Asking OpenSSL to Verify Server's Certificate

PKI Tutorials - Herong's Tutorial Examples

∟PHP Scripts Communicating with HTTPS Servers

∟Asking OpenSSL to Verify Server's Certificate

This section provides a tutorial example on how to ask the OpenSSL module to verify HTTPS server's certificate using 'verify_peer' SSL context option.

Based on the documentation of "SSL context options", the OpenSSL module does not verify HTTPS server certificates by default. In this tutorial, I want to show you how to ask Open OpenSSL to verify server certificate when communicating with https://login.yahoo.com.

1. Get a copy of the root CA certificate that for login.yahoo.com certificate. This can be done by using Firefox 3 to visit https://login.yahoo.com. Read the Firefox 3 chapter of this book for more details.

Run Firefox 3 and go to https://login.yahoo.com.
Click the Lock icon on the right bottom corner of the browser window.
Click "View Certificate" button and go to the "Details" tab.
Select the root certificate, "GTE CyberTrust Global Root", in the Certificate Hierarchy section and click "Export..." button.
Save the root certificate in "CA_Bundle.crt" using the "X.509 Certificate (PEM) format.

2. Modify the OpenSSL test script:

<?php
# OpenSSL_HTTPS_file_get_contents_with_CA.php
#- Copyright (c) 2010-2018 HerongYang.com. All Rights Reserved.
#
$script = array_shift($argv);
$url = array_shift($argv);

$context = stream_context_create(array(
    'ssl' => array(
        'verify_peer' => true,
        'cafile' => 'CA_Bundle.crt'
    )
));

$html = file_get_contents($url, false, $context);
echo $html;
?>

3. Run the modified test script:

herong> \local\php\php OpenSSL_HTTPS_file_get_contents_with_CA.php \
   https://login.yahoo.com

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3....
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Sign in to Yahoo!</title>

<meta http-equiv="Pragma" content="no-cache">
...