dunglas
commented
3 months ago Hi,
What's in the .crt file?
Closed geoidesic closed 3 months ago
dunglas
commented
3 months ago Hi,
What's in the .crt file?
geoidesic
commented
3 months ago Hi,
What's in the
.crtfile?
Which one? The one I'm trying to point it to is autogenerated by frankenphp. The one it's pointing to I have no idea, presumably it's the default installed by Alma Linux 9, or php-curl – it's the same default on both servers.
dunglas
commented
3 months ago With the static binary, you must download a CA bundle from https://curl.se/docs/caextract.html, and curl.cainfo must point to this file. AFAIK doesn't include a CA bundle by default. Pointing to the generated local certificate will not work (it's not the same thing).
geoidesic
commented
3 months ago Should I overwrite the existing ones?
lrwxrwxrwx. 1 root root 49 Sep 12 2023 ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
lrwxrwxrwx. 1 root root 55 Sep 12 2023 ca-bundle.trust.crt -> /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crtI tried the curl command suggested on that page you linked:
[root@dev tmp]# curl --etag-compare etag.txt --etag-save etag.txt --remote-name https://curl.se/ca/cacert.pem
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
curl: (77) error setting certificate file: /etc/pki/tls/certs/ca-bundle.crtBut it yields an error. I don't know what I'm doing here.
dunglas
commented
3 months ago If you already have a CA bundle provided by your distribution, set curl.cainfo = /etc/pki/tls/certs/ca-bundle.crt, that should should do the trick.
geoidesic
commented
3 months ago I was confused. I thought you said I must download a CA bundle? The bundles I mentioned above were for some reason empty. When I downloaded the cert from frankenphp it also was empty. 🤷 I tried again and then it wasn't empty. Once I symlinked that:
lrwxrwxrwx 1 root root 32 Aug 20 00:02 ca-bundle.crt -> frankenphp/cacert-2024-07-02.pemand then set that in CURLOPT:
curl_setopt($ch, CURLOPT_CAINFO, '/etc/ssl/certs/ca-bundle.crt');I got a different error:
Error: Received HTTP/0.9 when not allowedThen I had to add this to get it to work:
curl_setopt($ch, CURLOPT_HTTP09_ALLOWED, true);... but it seems to be working now.
Tx for the help!
geoidesic
commented
3 months ago Although having said that... this is all in aid of trying to get APNS (apple push notifications) working... and they aren't working. I can get them to work with Caddy PHP-fpm but not with frankenphp.
geoidesic
commented
3 months ago The response contains an error:
@@uÿÿÿUnexpected HTTP/1.x request: POST /3/device/7ee43e5089a1c9b24cbdf87c671f187eb78d9eb29b1a62fbb744e88a3e306e09I think maybe the problem is that cURL is configured without http2 support. This is from phpinfo:
HTTP2 | NoSo then the question becomes, how do I get a version of frankenphp with HTTP2 enabled for cURL?
Although I also don't understand why it was necessary to enable CURLOPT_HTTP09_ALLOWED because APNS should not be sending back an HTTP v0.9 response. (Maybe it's because HTTP2 isn't available and it's some kind of fallback).
geoidesic
commented
3 months ago Do I need to Compile from source with a dynamic PHP library? I.e. https://frankenphp.dev/docs/compile/
I was hoping to avoid that because it sounds complicated and the documentation seems sketchy at best, with English grammar errors that make it even more confusing.
dunglas
commented
3 months ago Feel free to open a PR to improve the docs (there is an "edit" button at the bottom of the page), or to provide a minimal reproducer if you think there is a bug.
Regarding curl options, we use Static PHP CLI under the hood. It may have less compilation options enabled. You may also try to use the Docker images we provide, which comes with HTTPS working out of the box and can be compiled with more curl features.
dunglas
commented
3 months ago I fixed some grammar issues in #646, and #988 should add HTTP/2 support to ext-curl.
geoidesic
commented
3 months ago Ok thanks for that quick response. How do I get to use the change that you've made in #988? Is there a static build of frankenphp that I can download or is it some other way?
geoidesic
commented
3 months ago P.S. I feel like frankenphp would benefit from a Discord channel. Good way to build a community.
geoidesic
commented
3 months ago You may also try to use the Docker images we provide, which comes with HTTPS working out of the box and can be compiled with more curl features.
I'm deploying to a VPS so Docker isn't an option for me.
dunglas
commented
3 months ago If your VPS runs on Linux, Docker will have basically no overhead.
geoidesic
commented
3 months ago If your VPS runs on Linux, Docker will have basically no overhead.
Sounds nice but I don't know how to administer that as a sys admin. So that's a whole other can of worms to go opening.
Is there a way for me to get your update from #988 without going down the docker rabbit hole?
dunglas
commented
3 months ago You can test with this binary: https://github.com/dunglas/frankenphp/actions/runs/10469568629/artifacts/1832668003
geoidesic
commented
2 months ago That did the trick! APN's are sending! Tx @dunglas
What happened?
I have set the
curl.cainfovalue in/etc/php.d/my-app.iniYou can see this value showing up in the
phpinfobelow. However, curl is not using this value. It's defaulting to something else.I've also tried setting it directly:
... but even then it doesn't pick that up.
The cURL error is
SSL certificate problem: unable to get local issuer certificate.I don't have this problem when using Caddy with PHP-FPM.
This script demonstrates the problem:
The output from this is:
So you can see from the first Array output from
ini_get_all('curl')that the cert location has been set correctly. However, the output ofcurl_getinfo()shows that curl is not using that value.On the Caddy PHP-FPM server (where it's working), the
curl_getinfo()output is this:So here it doesn't even register the
cainfobits... but yet it works. No SSL certificate problem.Build Type
Official static build
Worker Mode
No
Operating System
GNU/Linux
CPU Architecture
x86_64
PHP configuration
Relevant log output