Bug #78362 [Com]: cURL doesn't respect CURLOPT_SSLVERSION
| From: | mah at jump-ing dot de | Date: | Thu, 01 Aug 2019 18:30:16 +0000 |
| Subject: | Bug #78362 [Com]: cURL doesn't respect CURLOPT_SSLVERSION | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-222050@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=78362&edit=1
ID: 78362
Comment by: mah at jump-ing dot de
Reported by: mah at jump-ing dot de
Summary: cURL doesn't respect CURLOPT_SSLVERSION
Status: Not a bug
Type: Bug
Package: cURL related
Operating System: Ubuntu 19.04
PHP Version: 7.3.8
Block user comment: N
Private report: N
New Comment:
Thanks. It's a documentation bug then, https://www.php.net/manual/en/function.curl-setopt.php
neither mentions this to be the minimum accepted TLS version, nor CURL_SSLVERSION_MAX_xxx at all.
I'll file one there.
Previous Comments:
------------------------------------------------------------------------
[2019-08-01 18:11:00] requinix@php.net
Check
https://curl.haxx.se/libcurl/c/CURLOPT_SSLVERSION.html
to see what that constant actually means.
------------------------------------------------------------------------
[2019-08-01 18:09:01] mah at jump-ing dot de
See also https://stackoverflow.com/questions/57297524/php-curl-enforce-low-tls-version
------------------------------------------------------------------------
[2019-08-01 18:05:03] mah at jump-ing dot de
Description:
------------
Trying to connect with an intentionally lower TLS version, set by CURLOPT_SSLVERSION, connects with
the highest supported TLS version instead. This makes the CURLOPT_SSLVERSION setting pretty moot.
Test script:
---------------
<?php
echo 'PHP version: ' . phpversion() . PHP_EOL;
echo 'cURL version: ' . curl_version()['version'] . PHP_EOL;
$ch = curl_init('https://www.howsmyssl.com/a/check');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
//curl_setopt($ch, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_0);
curl_setopt($ch, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_1);
//curl_setopt($ch, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
$data = curl_exec($ch);
curl_close($ch);
$json = json_decode($data);
echo ($data ? $json->tls_version : 'curl request failed') . PHP_EOL;
Expected result:
----------------
This output:
PHP version: 7.3.7-2+ubuntu19.04.1+deb.sury.org+1
cURL version: 7.64.0
TLS 1.1
Actual result:
--------------
This output (last line), no matter what's choosen for CURLOPT_SSLVERSION:
PHP ...
cURL ...
TLS 1.3
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=78362&edit=1