19

I have a webapplication that makes a curl call to a different site to get data. Since my webspace provider (ionos) made some changes to the server, the curl call is no longer working.

my curl call looked like this:

$ch = curl_init();
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_URL, $link);
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$sResult = curl_exec($ch);
curl_close($ch);

It didnt work. $sResult was empty. I changed my code and tried

$test = file_get_contents($link);

this gives me the error:

PHP Warning:  file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages:
error:141A318A:SSL routines:tls_process_ske_dhe:dh key too small

is there something missing in my curl call or file_get_contents call?

1
  • The certificates for the target server either need to be improved or you must somehow configure openssl to allow dh keys that are too small. I'm not a PHP guy so that's the best I can tell you. It could be that changing the settings system wide will work but it isn't super secure. askubuntu.com/questions/1233186/…
    – Jon
    Aug 3, 2020 at 22:20

4 Answers 4

30

The usual recommendation for this error is to set the "CipherString" parameter in /etc/ssl/openssl.cnf to "DEFAULT:@SECLEVEL=1".

In PHP, you can achieve the same thing with curl_setopt():

curl_setopt($ch, CURLOPT_SSL_CIPHER_LIST, 'DEFAULT@SECLEVEL=1');

This is a better solution than editing openssl.cnf since it allows you to relax security for just one specific call, rather than system-wide.

10

If you are using the file_get_contents() function, this works nicely

$context=array(
    "ssl"=>array(
        'ciphers' => 'DEFAULT:!DH'
    ),
); 

$json = file_get_contents($url, false, stream_context_create($context));
2

I was getting this error on the curl command line.

curl request

curl -k 
     --request POST 
     --url 'https://abc.com.pk/token/api?grant_type=client_credentials' 
     --header 'Authorization: Basic a0NiZXNMTXFlJBY1lBQjJINmtqWVFh' 
     --ciphers DEFAULT@SECLEVEL=1

Solution:

--ciphers DEFAULT@SECLEVEL=1
1

To work around that problem, the legacy cipher suites must be enabled by:

update-crypto-policies --set LEGACY

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.