Re: PHP and SSL question

Jeff, See below. Jeff wrote: > > Matt, (and all others who can help) > > Thanks for your quick reply. I read over your tutorial and also > checked out the cURL site and the PHP4 docs. I still have a bunch > of confused questions. > > First, we have gone through the effort of building Apache > with mod-ssl, and we're in the process of getting a cert from > Thawte. Has this effort been wasted? It looks like cURL works > independently of mod-ssl and Apache unless I have misunderstood. > cURL does work independantly, your SSL sertificate is only to secure pages on your site being served to an SSL client (ie a browser or cURL or whatever calling YOUR server). > Second, if you use the exec command as in the tutorial, is this > a security problem? It seems that anyone hitting ps should be able > to see your full command line. Conversely, when PHP4 runs the > curl_exec() function, does this also execute an external program > or a linked function? > Yes, it is "insecure" in that way. In my environments i have been the only person with a shell it its been ok. The cURL functions in PHP4 are internal, no external application calls here. > Third, Is there a way to get the PHP4 curl functions to return > the results to the script, as your tutorial does? All the docs > seem to indicate that these functions want to send and receive > files, which will create additional overhead to create the output > file, parse the result file then delete both files, etc. not sure, Im sure you could stuff the results into a variable. > > Fourth, does the curl_exec() function wait for the remote server > to finish processing the request, store the result and return a > result code prior to continuing the php script? What are the > possible result codes? > No idea, I'd be reading up on the curl extension for PHP4 or the code from libcURL. > This cURL function is very new so I guess not many people have > played with it yet, but I'd appreciate any further input. > there has been talk on the php-dev list a bit lately. > Again, thanks for pointing me in the right direction so far. It > would be a lot easier if php could use mod-ssl. If mod-ssl is > installed and if you specify port 443 then fsockopen should use > mod-ssl to talk to the remote system. I'm sure I'm oversimplifying > this, but is there any chance of getting php to do this? > dont think thatll work. > Jeff > > Matt Allen wrote: > > > > Hi Jeff, > > > > Check out this link: > > > > http://www.phpbuilder.com/columns/matt20000305.php3 > > > > You cant use fsockopen() to talk SSL, you need an external app OR use PHP4's new > > cURL compatability. > > > > Matta > > > > Jeff wrote: > > > > > > My ISP has set up mod_ssl on my server and I need to do > > > some PHP scripting with it. > > > > > > If I use fsockopen to open a connection to the remote > > > server and transmit and receive data with it, does the > > > data get encryped and decrypted, or does this bypass > > > the security layer? > > > > > > Anyone have any other resources I can check out for doing > > > SSL with PHP and Apache? > > > > > > TIA > > > Jeff Wolkove > > > > > > PS - is the news server down? I can't connect to news.php.net > > > > > > -- > > > PHP General Mailing List (http://www.php.net/) > > > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > > > For additional commands, e-mail: php-general-help@lists.php.net > > > To contact the list administrators, e-mail: php-list-admin@lists.php.net > > > > -- > > Matt Allen Linux/PHP eCommerce Solutions > > Linux Worx Linux Networking > > www.linuxworx.com.au Consulting > > matt@linuxworx.com.au > > 0413 777 771 > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net -- Matt Allen Linux/PHP eCommerce Solutions Linux Worx Linux Networking www.linuxworx.com.au Consulting matt@linuxworx.com.au 0413 777 771