连接易趣时出现“SSL证书问题”

Question

我想从易趣检索类别。这是我的代码：

function getCategories(){


    $endpoint = "https://api.ebay.com/ws/api.dll";
    //$endpoint = 'http://svcs.ebay.com/services/search/FindingService/v1';

    $api_dev_name = "XXX";
    $api_app_name = "XXX";
    $api_cert_name = "XXX";
    $auth_token = "XXX";

    $headers = array(
        'X-EBAY-API-COMPATIBILITY-LEVEL: 819',
        'X-EBAY-API-DEV-NAME: '.$api_dev_name,
        'X-EBAY-API-APP-NAME: '.$api_app_name,
        'X-EBAY-API-CERT-NAME: '.$api_cert_name,
        'X-EBAY-API-CALL-NAME: GetCategories',
        'X-EBAY-API-OPERATION-NAME: GetCategories',
        'X-EBAY-API-SITEID: EBAY-US',
        'Content-Type:text/xml'
    );

    $xmlRequest = "<?xml version=\"1.0\" encoding=\"utf-8\"?>";
    $xmlRequest .= "<GetCategoriesRequest xmlns=\"urn:ebay:apis:eBLBaseComponents\">";
    $xmlRequest .= "<RequesterCredentials>";
    $xmlRequest .= "<eBayAuthToken>{$auth_token}</eBayAuthToken>";
    $xmlRequest .= "</RequesterCredentials>";
    $xmlRequest .= "<CategorySiteID>0</CategorySiteID>";
    $xmlRequest .= "<DetailLevel>ReturnAll</DetailLevel>";
    $xmlRequest .= "</GetCategoriesRequest>";
    $xmlRequestEncode = utf8_encode($xmlRequest);

    $curl = curl_init();

    curl_setopt_array($curl,
        array(
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_URL => $endpoint,
            CURLOPT_POST => true,
            CURLOPT_POSTFIELDS => $xmlRequestEncode,
            CURLOPT_HTTPHEADER => $headers
        )
    );

    $response = curl_exec($curl);

    if (!$response) {
        die('Error: "' . curl_error($curl) . '" - Code: ' . curl_errno($curl));
    } else {
        echo $response;
    }

    curl_close($curl);
}

getCategories();

$api_dev_name、$api_app_name、$api_cert_name和$auth_token在正式生产环境中有效、活动并设置。

我从curl得到这个错误：

错误：“SSL证书问题，请验证CA证书是否正常。详细信息：错误：14090086：SSL例程：SSL3\u GET\u SERVER\u证书：证书验证失败”-代码：60

为什么会出现此错误？

Answer 1

只需在curl\u setopt\u数组中添加新的两行，

CURLOPT_SSL_VERIFYPEER => false, // new code
CURLOPT_SSL_VERIFYHOST => false // new code

Answer 2

根据OpenSSL的s\U客户端：

$ openssl s_client -connect svcs.ebay.com:443
CONNECTED(00000003)
depth=2 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3 Public Primary Certification Authority - G5
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/C=US/ST=California/L=San Jose/O=eBay, Inc./OU=eBay Site Operations/CN=svcs.ebay.com
   i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3
 1 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3
   i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
 2 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
   i:/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority - G2/OU=(c) 1998 VeriSign, Inc. - For authorized use only/OU=VeriSign Trust Network
---
...

因此，您需要信任Class 3公共初级证书颁发机构-G2。您可以下载表单Verisign根证书。抓取带有指纹的标记为根1的指纹85 37 1c a6 e5 50 14 3d ce 28 03 47 1b de 3a 09 e8 f8 77 0f。

下载ZIP文件后，可以在第2代（G2）PCAs文件夹中找到它。其命名的Class 3公共主证书颁发机构-G2。pem。

最后，告诉cURL使用您下载的根证书。我去不了cURL的cURL文档。哈克斯。现在是se，所以我不能告诉你打电话做什么。

不要将数百个CA加载到CA文件中。您知道Verisign认证易趣的证书，因此只使用所需的Verisign CA。不要让攻击者让您相信其他内容（例如，Truswave声称他们认证易趣）。