Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #7746

Re: imap_open: Certificate Error, but only in PHP

Show all headers | View raw

Florian Zeisel wrote:
> Hi everyone,
>
> this week, one of my php scripts suddenly stopped working. I received the following errors:
> It started with: "unable to locate common name", then after a while it was "invalid remote specification".
>
> The code is:
> $srv = '{mail.twooit.com:993/imap/ssl/}';
> $conn = imap_open($srv, $mailuser, $mailpass) or die("can't connect: " . imap_last_error());
>
> It seems the provider installed a new certificate. Openssl on the terminal results in:
> depth=1 /C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=PositiveSSL CA 2
> verify error:num=20:unable to get local issuer certificate
> verify return:0
>
> After some research, I was able to make it work by adding the "novalidate-cert" option.
> However, this means that the script does not authenticate the server anymore, which
> cannot be the solution! At least: Is it correct to assume that passwords and mails are
> still transferred encrypted? It might not be that much of a problem, because the script
> is also executed at that provider (different IP address though), and man-in-the-middle
> risk is therefore low..

Yes, the data will still be transferred encrypted, but you could have a man in 
the middle without knowing it.

you could try to verify that the certificate belongs to the "host" which you 
connect to, this should at least remove the risk of a random certificate to be 
used in a man in the middle attack.


> HOWEVER, my Thunderbird email client and also smartphone are still connecting
> without any certificate errors and ssl-check websites say, that the certificate is ok...

have you controlled that it's the same certificate used in thunderbird as the 
one you got when you checked with openssl from the machine where the php 
script runs?

Also the machine which runs the script may have limited access to the internet 
or and having another trusted CA list than your phone/desktop has.


> Can anyone help me to fix this, please?

I doubt this has to do with your PHP code and those it's something off topic 
on this newsgroup.


-- 

   //Aho

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

imap_open: Certificate Error, but only in PHP Florian Zeisel <flo74@yahoo.de> - 2012-12-08 14:01 +0100
  Re: imap_open: Certificate Error, but only in PHP "J.O. Aho" <user@example.net> - 2012-12-08 16:54 +0100
    Re: imap_open: Certificate Error, but only in PHP Florian Zeisel <flo74@yahoo.de> - 2012-12-08 21:30 +0100
  Re: imap_open: Certificate Error, but only in PHP "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-12-08 17:10 +0100
    Re: imap_open: Certificate Error, but only in PHP Florian Zeisel <flo74@yahoo.de> - 2012-12-08 21:33 +0100
      Re: imap_open: Certificate Error, but only in PHP Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-08 19:19 -0500
      Re: imap_open: Certificate Error, but only in PHP "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-12-09 13:15 +0100

csiph-web