Home 資訊科技 Paypal Upgrade (RESOLVED徹底解決...

(RESOLVED徹底解決)如何將paypal安全升級技巧(下)-TLS 1.2 及 HTTP/1.1 升級

494

Test the TLS version is compatible with PayPal OK

徹底解決paypal安全升級為TLS1.2及HTTP1.1的方案：還在為主機出現string(17) "SSL connect error"的問題而煩惱不堪嗎？

還在為了即將在2016年6月17日的deadline而緊張嗎？如果您還在網路上不斷的用google找答案作功課，看一堆英文資料，找尋一大堆資料，但仍然無法解決問題嗎？看了這篇，讓您輕鬆昇級主機為符合paypal的要求。

在上一篇如何將paypal安全升級技巧(下)-TLS 1.2 及 HTTP/1.1 升級中，我們經過了更新curl、NSS及增加一個設定為tls1.2的參數

curl_setopt ($ch, CURLOPT_SSLVERSION, 6); //Integer NOT string TLS v1.2

1	curl_setopt ($ch, CURLOPT_SSLVERSION, 6); //Integer NOT string TLS v1.2

但是在實務上，在底下的程式碼中，加入這一行後

curl_setopt ($ch, CURLOPT_SSLVERSION, 6); //Integer NOT string TLS v1.2
curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $req);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, CURLOPT_FORBID_REUSE, 1);

curl_setopt ($ch, CURLOPT_SSLVERSION, 6); //Integer NOT string TLS v1.2

curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);

curl_setopt($ch, CURLOPT_POST, 1);

curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);

curl_setopt($ch, CURLOPT_POSTFIELDS, $req);

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 1);

curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);

curl_setopt($ch, CURLOPT_FORBID_REUSE, 1);

經過測試，發現程式根本無法執行。

接著在持續研究後，發現，其實主機本身要支援TLS1.2；要透過更新curl到比較新的版本

在官網中，可以發現最新版本就是7.48.0；

在Centos 6的主機呢？最方便的更新方法就是使用yum，

yum update libcurl

1	yum update libcurl

但卻發現，正常的repo中，卻不含新版的rpm版本

因此我們需要使用其他repo

rpm -Uvh http://nervion.us.es/city-fan/yum-repo/rhel6/x86_64/city-fan.org-release-1-13.rhel6.noarch.rpm

1	rpm -Uvh http://nervion.us.es/city-fan/yum-repo/rhel6/x86_64/city-fan.org-release-1-13.rhel6.noarch.rpm

接著到修改/etc/yum.repos.d/city-fan.repo

[CityFan]
name=City Fan Repo
baseurl=http://nervion.us.es/city-fan/yum-repo/rhel$releasever/$basearch/
enabled=1
gpgcheck=0

[CityFan]

name=City Fan Repo

baseurl=http://nervion.us.es/city-fan/yum-repo/rhel$releasever/$basearch/

enabled=1

gpgcheck=0

將gpgcheck改成0

執行底下指令

yum clean all
yum install libcurl

1 2	yum clean all yum install libcurl

安裝完成後，檢查一下

curl -V
curl 7.48.0 (x86_64-redhat-linux-gnu) libcurl/7.48.0 OpenSSL/1.0.1e zlib/1.2.3 c-ares/1.11.0 libidn/1.18 libssh2/1.7.0
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp 
Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz UnixSockets Metalink

curl -V

curl 7.48.0 (x86_64-redhat-linux-gnu) libcurl/7.48.0 OpenSSL/1.0.1e zlib/1.2.3 c-ares/1.11.0 libidn/1.18 libssh2/1.7.0

Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp

Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz UnixSockets Metalink

接著將原本的修改過的paypal測試程式，在該行程式前面加上// remark掉。
//curl_setopt ($ch, CURLOPT_SSLVERSION, 6); //Integer NOT string TLS v1.2

<?php

// Test from PayPal 
echo 'Test if the TLS version is compatible with PayPal:<br/>';
$ch = curl_init(); 
//curl_setopt ($ch, CURLOPT_SSLVERSION, 6); //Integer NOT string TLS v1.2
curl_setopt($ch, CURLOPT_URL, "https://tlstest.paypal.com/"); 
echo '&nbsp;curl_exec($ch): ';
var_dump(curl_exec($ch));
echo '<br/>&nbsp;curl_error($ch): ';
var_dump(curl_error($ch));
curl_close($ch);

// Test from https://github.com/paypal/adaptivepayments-sdk-php/issues/64
echo '<br/><br/>Another test, get TLS & SSL Version:<br/>';
$ch = curl_init('https://www.howsmyssl.com/a/check');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$data = curl_exec($ch);
$json = json_decode($data);
echo ' TLS Version: ';
echo $json->tls_version;

$curl_info = curl_version();
echo '<br/> SSL Version: ';
echo $curl_info['ssl_version'];
curl_close($ch);

?>

<?php

// Test from PayPal

echo 'Test if the TLS version is compatible with PayPal: ';

$ch = curl_init();

//curl_setopt ($ch, CURLOPT_SSLVERSION, 6); //Integer NOT string TLS v1.2

curl_setopt($ch, CURLOPT_URL, "https://tlstest.paypal.com/");

echo ' curl_exec($ch): ';

var_dump(curl_exec($ch));

echo '  curl_error($ch): ';

var_dump(curl_error($ch));

curl_close($ch);

// Test from https://github.com/paypal/adaptivepayments-sdk-php/issues/64

echo ' Another test, get TLS & SSL Version: ';

$ch = curl_init('https://www.howsmyssl.com/a/check');

curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$data = curl_exec($ch);

$json = json_decode($data);

echo ' TLS Version: ';

echo $json->tls_version;

$curl_info = curl_version();

echo ' SSL Version: ';

echo $curl_info['ssl_version'];

curl_close($ch);

再執行程式檢測一次

Test if the TLS version is compatible with PayPal:
 curl_exec($ch): PayPal_Connection_OKbool(true) 
 curl_error($ch): string(0) "" 

Another test, get TLS & SSL Version:
TLS Version: TLS 1.2
SSL Version: OpenSSL/1.0.1e

Test if the TLS version is compatible with PayPal:

curl_exec($ch): PayPal_Connection_OKbool(true)

curl_error($ch): string(0) ""

Another test, get TLS & SSL Version:

TLS Version: TLS 1.2

SSL Version: OpenSSL/1.0.1e

有發現什麼不一樣嗎？

首先第2行，出現PayPal_Connection_OKbool(true)

接著倒數第2行，TLS Version出現TLS 1.2

這時候您的主機就完全相容於paypal新的安全更新囉。

本文章，為原創內容，歡迎轉貼連結分享，未經同意，禁止全文轉載。

參考資料：

自已
https://www.digitalocean.com/community/questions/how-to-upgrade-curl-in-centos6

回覆留言 取消回覆

回覆留言取消回覆