“无法获取本地颁发者证书”和“tlsv1 无法识别的名称”

Question 1

openssl s_client -connect paypal.com:443

我不是网络专家，所以我无法帮助您了解 PHP。我可以帮助您执行此命令，并向您展示如何使用 OpenSSL 进行故障排除。

您想要使用 TLS 1.0 或更高版本，并且想要使用服务器名称指示 (SNI)。因此该命令应该用于-servername征用 SNI，并-tls1使用 TLS 1.0。-tls1_2如果您愿意，您甚至可以使用：

$ openssl s_client -connect paypal.com:443 -servername paypal.com -tls1
CONNECTED(00000005)
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 High Assurance Server CA
verify error:num=20:unable to get local issuer certificate
Server did acknowledge servername extension.
...
New, SSLv3, Cipher is AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1
    Cipher    : AES256-SHA
    Session-ID: 78A62BA404C4AA8731D4FA5658820840A014955818597872E725ADBBE29AB06B
    Session-ID-ctx: 
    Master-Key: DCE1A463B22DEB10AEA4CECD6C89560502F1F67583C0DDDDF81B0FD99D31C83AE81AA484C32ADC6E312AEC8AB5FE86D1
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1478608307
    Timeout   : 7200 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
    Extended master secret: no

您可以清除Verify return code: 20 (unable to get local issuer certificate)通过-CAfile与使用DigiCert 高保证 EV 根 CA。您可以从以下位置获取它DigiCert 受信任的根颁发机构证书。获取它后，您需要将其从 DER 转换为 PEM。

$ wget https://www.digicert.com/CACerts/DigiCertHighAssuranceEVRootCA.crt
...

$ file DigiCertHighAssuranceEVRootCA.crt 
DigiCertHighAssuranceEVRootCA.crt: data

$ openssl x509 -in DigiCertHighAssuranceEVRootCA.crt -inform DER \
              -out DigiCertHighAssuranceEVRootCA.pem -outform PEM

$ file DigiCertHighAssuranceEVRootCA.pem 
DigiCertHighAssuranceEVRootCA.pem: ASCII text

然后发出以下内容。注意它以Verify return code: 0 (ok)。

$ openssl s_client -connect paypal.com:443 -servername paypal.com -tls1 -CAfile DigiCertHighAssuranceEVRootCA.pem 
CONNECTED(00000005)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 High Assurance Server CA
verify return:1
depth=0 C = US, ST = California, L = San Jose, O = "PayPal, Inc.", OU = PayPal Production, CN = paypal.com
verify return:1
Server did acknowledge servername extension.
...
New, SSLv3, Cipher is AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1
    Cipher    : AES256-SHA
    Session-ID: 53D6D36E366E7A68D458ABABFB9A08E5F1EC49287E6265D008B3C8EAB3098951
    Session-ID-ctx: 
    Master-Key: 13C070B784545ED1F11608E4871936CABF9BFC8A4320C025003ABE05320C3598342500BB12C90F89270B19D26D793A96
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1478608643
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no

最后，您需要做的就是告诉 PHP 和 cURL 使用DigiCertHighAssuranceEVRootCA.pem.您的 cURL 命令可能类似于：

curl www.paypal.com:443 --tlsv1.0 --cacert DigiCertHighAssuranceEVRootCA.pem

我不知道用 PHP 做什么。

Answer