Failed to access a TLS server

[guss77]

Trying to access TLS servers, I keep getting errors. For example when trying to access https://www.google.com , I get this:

An error occurred in the underlying stream:
Unable to complete SSL/TLS handshake:
stream_socket_enable_crypto():
Peer certificate CN=`www.google.com' did not match expected CN=`74.125.140.106'

My code is:

        $request = $this->client->request('GET', 'https://www.google.com', [ ]);
        $request->on('error', function ($err) use ($callback) { $callback($err, NULL); });
        $request->on('response', function ($response) {
            $response->on('data', function ($data, $response) {
                echo "Got response data";
                var_dump([$data, $response]);
            });
        });
        $request->end();

[WyriHaximus]

This looks oddly familiair, what PHP version and what react/http-client version are you using?

[clue]

This is a known issue that has been fixed with reactphp-legacy/socket-client#61 (occurs with any version of PHP 5.6+). We have yet to tag a new release and update this component to use the new dependency.

[guss77]

I'm using PHP 5.6, but I'm wandering if it will work with php 5.5 ?

[guss77]

Requiring react/socket-client=dev-master solved the problem for me.

[clue]

I'm using PHP 5.6, but I'm wandering if it will work with php 5.5 ?

PHP < 5.6 defaults to verify_peer = false, which means that it should work fine with either version of socket-client.
PHP >= 5.6 defaults to verify_peer = true and the required SSL context options are only set with the (future) v0.5 socket-client.

Requiring react/socket-client=dev-master solved the problem for me.

Thanks for verifying and reporting back! I guess it makes sense to keep this ticket open until a new tag has been released 👍

[WyriHaximus]

I guess it makes sense to keep this ticket open until a new tag has been released 👍

Sounds like a solid plan to me 👍

[guss77]

I've tested on PHP 5.5, and something weird is happening - with either the default socket-client as well as dev-master:

I'm trying to access a server behind a Cloudflare proxy, and when I try using PHP 5.6, everything works fine (assuming socket-client=dev-master). Under PHP 5.5 though (both socket-client versions), I get a 403 Forbidden error, with an HTML page that contains this text:

Error
Ray ID: 28433ad97dec265a * 2016-03-15 21:58:58 UTC
HTTP hostname and TLS SNI hostname mismatch
You've requested an IP address that is part of the CloudFlare network. The request's Host header does not match the request's TLS SNI Host header.

[clue]

Thanks for the report @guss77!

SSL/TLS support in older version of PHP has always been flaky, so as a rule of thumb, using the latest supported version if generally a good idea :)

In this particular case, I suppose we need some more information before we can track this down, such as exact PHP version, OpenSSL version, composer package versions and a minimal test script to reproduce this issue.

For example, support for SNI was […] added in 5.3.2 and requires PHP to be built with OpenSSL 0.9.8j or greater (http://php.net/manual/en/openssl.constsni.php).

I hope this helps pinpoint any issues 👍