php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #67609 TLS encryption fails behind HTTP proxy
Submitted: 2014-07-12 04:07 UTC Modified: 2014-07-12 15:19 UTC
From: [email protected] Assigned: rdlowrey (profile)
Status: Closed Package: OpenSSL related
PHP Version: 5.6.0RC2 OS: centos
Private report: No CVE-ID: None
View Developer Edit
 [2014-07-12 04:07 UTC] [email protected] 
Description:
------------
Connection to encrypted resources from behind an HTTP proxy using 5.6.0RC2 always fails. The failure is unaffected by manually assigning the appropriate SSL stream context options. This bug only manifests when connecting via SSL/TLS through a proxy server and other use-cases are unaffected.

Test script:
---------------
<?php
// Must have exported proxy environment vars, e.g.:
// export http_proxy=http://127.0.0.1:8888
// export https_proxy=$http_proxy

// fails :(
$html = file_get_contents('https://google.com');
var_dump(strlen($html));

Expected result:
----------------
int(%d)

Actual result:
--------------
SSL operation failed with code 1. OpenSSL Error messages:
error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2014-07-12 04:18 UTC] [email protected]
-Status: Open +Status: Assigned -Assigned To: +Assigned To: rdlowrey
 [2014-07-12 04:18 UTC] [email protected] 
The problem here is two-fold:

(1) The existing ssl proxying code still uses the STREAM_CRYPTO_METHOD_SSLv23_CLIENT constant. In previous versions this constant meant "any available SSL/TLS protocol." However in 5.6 this constant now represents "only SSLv2 or SSLv3." Many servers disallow SSLv2/3 altogether as they are both known to be insecure. This results in failures for many servers. Fixing this issue requires a simple change to use the new (as of 5.6) STREAM_CRYPTO_METHOD_ANY_CLIENT crypto method constant.

(2) As of 5.6 ext/openssl automatically detects the host name from the HTTP request URI if no peer name is specified as part of the SSL stream context. For connections routed through a proxy, though, the proxy server's host name is detected and this results in handshake failures because the proxy name doesn't match the name on the remote server's certificate. The fix here is a matter of setting the appropriate server hostname if no peer_name is set in the SSL context to avoid auto-detection of the proxy server's name.

I've already fixed these issues locally. I'll commit the changes and update this report once I'm able to do due diligence and ensure I haven't missed any edge cases.
 [2014-07-12 15:19 UTC] [email protected]
-Status: Assigned +Status: Closed
 [2014-07-12 15:19 UTC] [email protected] 
This bug has been addressed in commit f3bf887e6d:

https://github.com/php/php-src/commit/f3bf887e6d84619fd03efc244756f68fa857b346
 [2018-08-20 17:22 UTC] [email protected] 
Related To: Bug #74796
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Sun May 11 03:01:27 2025 UTC