Re: [SOAP] PHP5 SoapClient: verify server certificate?

raol ha scritto:

Kevin Mendel wrote:

(1) It seems like verification of the server certificate is off by default. Is this correct? I cannot find any way to disable it or enable it or check it. Can the "verify peer" option be enabled? Can the option be queried? I see documentation for settings at the CURL or even the SSL level. But I am using the SoapClient, so it's no help. (Or is it?)

These questions would be very interesting for me too. I dont't think that the verification of the server-certificate is off by default. If I want to connect a soapClient to a https-webservice without further authentication and verification, the soapClient complains that it cannot establish a ssl-connection (openssl and curl are enabled). So I think it doesn't accept the server-certificate by default. But I use an untrusted server-certificate, maybe that's a difference.

the only way that i know is to create a valid certificate, no problem if it's selfsigned, but it must be valid for the called host. Webservices are like ordinary webClients ( browsers ) they prevent , in this case via openssl , to accept a certificate that doesn't fit the basic security policy. This is my experience , if someone got more infos , i'll be happy to go in deep with this :)