blocks|key|70189|text|然后，服务器将选择它和客户端都支持的版本。因此，假设您的客户端系统支持TLS1.2，那么您可能不需要执行任何操作。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|70190|在1.0.1中，OpenSSL增加了对TLS1.2的支持。如果你使用的是el6或更高版本，并且更新了你的包，你应该没问题。|70191|#+openssl+version
>+OpenSSL+1.0.2k-fips++26+Jan+2017|code-block|syntax|javascript|70192|您可以使用此nmap命令检查服务器支持的协议/密码：|70193|+nmap+--script+ssl-enum-ciphers+-p+443+stackoverflow.com|70194|现在，如果您想在使用TLS1.1时测试失败，或者强制使用密码之类的东西，那么您将需要使用PHP的stream_context_create。|offset|length|style|CODE|70195|使用下面的代码，您可以通过将crypto_method设置为STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT来强制使用to+1.2。|70196|<?php
$options+=+['trace'+=>+1,
++++++++++++'soap_version'+=>+SOAP_1_2,
++++++++++++'exceptions'+=>+true,
++++++++++++'location'+=>+'https://stackoverflow.com/foo',
++++++++++++'uri'+=>+"https://stackoverflow.com/bar",
++++++++++++'stream_context'+=>+stream_context_create([
++++++++++++++++'ssl'=>+[
++++++++++++++++++++'crypto_method'+=>+STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT,
++++++++++++++++++++'ciphers'+=>+'SHA256'++++++++++++++++++++++++
+++++++++++++++++]
+++++++++++++])];

$client+=+new+SoapClient(null,+$options);

try+{
++++$response+=+$client->getFoo();++++
}+catch+(\Exception+$e){++++
++++var_dump($client->__getLastRequest());
++++var_dump($client->__getLastResponse());
++++throw+$e;
}


//OR,+an+even+easier+test+with+out+a+Soap+Client...
$opts+=+[
+++++++++'ssl'=>+[
+++++++++++++'crypto_method'+=>+STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT,
+++++++++++++'ciphers'+=>+'SHA256',
+++++++++++++'verify_peer'+=>+false,
+++++++++++++'verify_peer_name'+=>+false
+++++++++]
+++++];

$context+=+stream_context_create($opts);
$fp+=+fopen('https://stackoverflow.com',+'r',+false,+$context);|70197|错误可能是这样的：|70198|70199|fopen()：无法启用加密|70200|70201|70202|70203|entityMap|0|LINK|mutability|MUTABLE|url|https://www.php.net/manual/en/function.stream-context-create.php^0|0|0|0|0|0|1C|L|1C|L|0|0|E|D|U|Z|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|1C|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1D|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|1E|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|1F|8|@]|9|@]|A|$]]|$1|K|3|L|5|F|7|1G|8|@]|9|@]|A|$G|H]]|$1|M|3|N|5|6|7|1H|8|@$O|1I|P|1J|Q|R]]|9|@$O|1K|P|1L|1|1M]]|A|$]]|$1|S|3|T|5|6|7|1N|8|@$O|1O|P|1P|Q|R]|$O|1Q|P|1R|Q|R]]|9|@]|A|$]]|$1|U|3|V|5|F|7|1S|8|@]|9|@]|A|$G|H]]|$1|W|3|X|5|6|7|1T|8|@]|9|@]|A|$]]|$1|Y|3|-4|5|6|7|1U|8|@]|9|@]|A|$]]|$1|Z|3|10|5|6|7|1V|8|@]|9|@]|A|$]]|$1|11|3|-4|5|6|7|1W|8|@]|9|@]|A|$]]|$1|12|3|-4|5|6|7|1X|8|@]|9|@]|A|$]]|$1|13|3|-4|5|6|7|1Y|8|@]|9|@]|A|$]]|$1|14|3|-4|5|6|7|1Z|8|@]|9|@]|A|$]]]|15|$16|$5|17|18|19|A|$1A|1B]]]]

When negotiating the connection with the server, your TLS library, let's assume openSSL, is going to tell the server what your maximum supported version is. The server will then choose a version that it, and the client both support. So, assuming your client system supports TLS1.2 there is probably no action required on your part. 

TLS 1.2 support was added to OpenSSL in 1.0.1. If you are on el6 or newer and update your packages you should be fine. Check your version like so:

<pre><code># openssl version
&gt; OpenSSL 1.0.2k-fips 26 Jan 2017
</code></pre>

You can check what protocols/ciphers a server supports with this nmap command:

<pre><code> nmap --script ssl-enum-ciphers -p 443 stackoverflow.com
</code></pre>

Now, if you want to test a failure when using TLS1.1, or force a cipher or something, you will need to use PHP's <a href="https://www.php.net/manual/en/function.stream-context-create.php" rel="nofollow noreferrer"><code>stream_context_create</code></a>.

With the code below you can force use of TLS1.2 by setting the <code>crypto_method</code> to
<code>STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT</code>. Or, perhaps more useful towards what you are asking, you could test the failure when forcing use of <code>STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT</code>. 

<pre><code>&lt;?php
$options = ['trace' =&gt; 1,
 'soap_version' =&gt; SOAP_1_2,
 'exceptions' =&gt; true,
 'location' =&gt; 'https://stackoverflow.com/foo',
 'uri' =&gt; "https://stackoverflow.com/bar",
 'stream_context' =&gt; stream_context_create([
 'ssl'=&gt; [
 'crypto_method' =&gt; STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT,
 'ciphers' =&gt; 'SHA256' 
 ]
 ])];

$client = new SoapClient(null, $options);

try {
 $response = $client-&gt;getFoo(); 
} catch (\Exception $e){ 
 var_dump($client-&gt;__getLastRequest());
 var_dump($client-&gt;__getLastResponse());
 throw $e;
}


//OR, an even easier test with out a Soap Client...
$opts = [
 'ssl'=&gt; [
 'crypto_method' =&gt; STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT,
 'ciphers' =&gt; 'SHA256',
 'verify_peer' =&gt; false,
 'verify_peer_name' =&gt; false
 ]
 ];

$context = stream_context_create($opts);
$fp = fopen('https://stackoverflow.com', 'r', false, $context);

</code></pre>

If things work with 1.2 and you can generate an error forcing say 1.1 then you can be pretty confident things are setup fine. Errors would be along the lines of:

<blockquote>
 Warning: fopen(): SSL operation failed with code 1. OpenSSL Error
 messages: error:140830B5:SSL routines:ssl3_client_hello:no ciphers
 available
 
 fopen(): Failed to enable crypto
</blockquote>

When talking about SOAP version <a href="https://www.w3.org/TR/soap/" rel="nofollow noreferrer">1.1</a> vs <a href="https://www.w3.org/TR/soap12/" rel="nofollow noreferrer">1.2</a> those are just different W3C standards for the Simple Object Access Protocol. More on some of the differences can be found <a href="https://stackoverflow.com/questions/8588309/what-is-the-difference-between-soap-1-1-soap-1-2-http-get-http-post-methods">here</a>.

I will just say in closing I've not tested this in PHP 5.5, that is such an old version that these days I don't have an easy way to spin it up. Think this would all still be applicable however.

We have a site on an old codebase using PHP 5.5 (for now) and one of our integrations we interface with using <code>SoapClient</code> has told us they will be disabling usage of TLS &lt; 1.2 shortly.

Currently our connections are as simple as:

<pre><code>$client = new SoapClient($soap_url);
</code></pre>

What do we have to do to make sure only TLS 1.2 requests are sent? I found <a href="https://stackoverflow.com/a/35920578/472501">this answer</a>, but I'm not entirely sure if this still applies to our situation; additionally, not sure we should be forcing Soap 1.1 either?

What are the requirements on our end to make sure we send TLS 1.2 requests?

Making sure SoapClient is sending TLS 1.2 requests in PHP 5.5

服务器

我们在一个使用PHP5.5的旧代码库上有一个网站(目前)，我们使用SoapClient的一个集成告诉我们，他们很快就会禁止使用TLS < 1.2。目前，我们的连接非常简单：$client = new SoapClient($soap_url);我们必须做什么才能确保只发送TLS 1.2请求？我找到了，但我不完全确定这是...

问确保SoapClient在PHP5.5中发送TLS1.2请求
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问确保SoapClient在PHP5.5中发送TLS1.2请求EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问确保SoapClient在PHP5.5中发送TLS1.2请求
EN