Closed geoidesic closed 3 weeks ago
Hi,
What's in the .crt
file?
Hi,
What's in the
.crt
file?
Which one? The one I'm trying to point it to is autogenerated by frankenphp. The one it's pointing to I have no idea, presumably it's the default installed by Alma Linux 9, or php-curl – it's the same default on both servers.
With the static binary, you must download a CA bundle from https://curl.se/docs/caextract.html, and curl.cainfo
must point to this file. AFAIK doesn't include a CA bundle by default. Pointing to the generated local certificate will not work (it's not the same thing).
Should I overwrite the existing ones?
lrwxrwxrwx. 1 root root 49 Sep 12 2023 ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
lrwxrwxrwx. 1 root root 55 Sep 12 2023 ca-bundle.trust.crt -> /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
I tried the curl
command suggested on that page you linked:
[root@dev tmp]# curl --etag-compare etag.txt --etag-save etag.txt --remote-name https://curl.se/ca/cacert.pem
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
curl: (77) error setting certificate file: /etc/pki/tls/certs/ca-bundle.crt
But it yields an error. I don't know what I'm doing here.
If you already have a CA bundle provided by your distribution, set curl.cainfo = /etc/pki/tls/certs/ca-bundle.crt
, that should should do the trick.
I was confused. I thought you said I must download a CA bundle? The bundles I mentioned above were for some reason empty. When I downloaded the cert from frankenphp it also was empty. 🤷 I tried again and then it wasn't empty. Once I symlinked that:
lrwxrwxrwx 1 root root 32 Aug 20 00:02 ca-bundle.crt -> frankenphp/cacert-2024-07-02.pem
and then set that in CURLOPT:
curl_setopt($ch, CURLOPT_CAINFO, '/etc/ssl/certs/ca-bundle.crt');
I got a different error:
Error: Received HTTP/0.9 when not allowed
Then I had to add this to get it to work:
curl_setopt($ch, CURLOPT_HTTP09_ALLOWED, true);
... but it seems to be working now.
Tx for the help!
Although having said that... this is all in aid of trying to get APNS (apple push notifications) working... and they aren't working. I can get them to work with Caddy PHP-fpm but not with frankenphp.
The response contains an error:
@@uÿÿÿUnexpected HTTP/1.x request: POST /3/device/7ee43e5089a1c9b24cbdf87c671f187eb78d9eb29b1a62fbb744e88a3e306e09
I think maybe the problem is that cURL is configured without http2
support. This is from phpinfo
:
HTTP2 | No
So then the question becomes, how do I get a version of frankenphp with HTTP2 enabled for cURL?
Although I also don't understand why it was necessary to enable CURLOPT_HTTP09_ALLOWED
because APNS should not be sending back an HTTP v0.9 response. (Maybe it's because HTTP2 isn't available and it's some kind of fallback).
Do I need to Compile from source with a dynamic PHP library? I.e. https://frankenphp.dev/docs/compile/
I was hoping to avoid that because it sounds complicated and the documentation seems sketchy at best, with English grammar errors that make it even more confusing.
Feel free to open a PR to improve the docs (there is an "edit" button at the bottom of the page), or to provide a minimal reproducer if you think there is a bug.
Regarding curl options, we use Static PHP CLI under the hood. It may have less compilation options enabled. You may also try to use the Docker images we provide, which comes with HTTPS working out of the box and can be compiled with more curl features.
I fixed some grammar issues in #646, and #988 should add HTTP/2 support to ext-curl.
Ok thanks for that quick response. How do I get to use the change that you've made in #988? Is there a static build of frankenphp that I can download or is it some other way?
P.S. I feel like frankenphp would benefit from a Discord channel. Good way to build a community.
You may also try to use the Docker images we provide, which comes with HTTPS working out of the box and can be compiled with more curl features.
I'm deploying to a VPS so Docker isn't an option for me.
If your VPS runs on Linux, Docker will have basically no overhead.
If your VPS runs on Linux, Docker will have basically no overhead.
Sounds nice but I don't know how to administer that as a sys admin. So that's a whole other can of worms to go opening.
Is there a way for me to get your update from #988 without going down the docker rabbit hole?
You can test with this binary: https://github.com/dunglas/frankenphp/actions/runs/10469568629/artifacts/1832668003
That did the trick! APN's are sending! Tx @dunglas
What happened?
I have set the
curl.cainfo
value in/etc/php.d/my-app.ini
You can see this value showing up in the
phpinfo
below. However, curl is not using this value. It's defaulting to something else.I've also tried setting it directly:
... but even then it doesn't pick that up.
The cURL error is
SSL certificate problem: unable to get local issuer certificate
.I don't have this problem when using Caddy with PHP-FPM.
This script demonstrates the problem:
The output from this is:
So you can see from the first Array output from
ini_get_all('curl')
that the cert location has been set correctly. However, the output ofcurl_getinfo()
shows that curl is not using that value.On the Caddy PHP-FPM server (where it's working), the
curl_getinfo()
output is this:So here it doesn't even register the
cainfo
bits... but yet it works. No SSL certificate problem.Build Type
Official static build
Worker Mode
No
Operating System
GNU/Linux
CPU Architecture
x86_64
PHP configuration
Relevant log output