Skip to content

Non-configurable cURL Options in HTTPConfig #17

Description

@ojtibi

The default cURL options in PayMaya\Core\HTTPConfig are fixed and are not very flexible. There are installations of PHP 5.6 and above where libcurl uses NSS instead of OpenSSL as the SSL/TLS provider, which means hard-coding CURLOPT_SSL_CIPHER_LIST to 'TLSv1' will be incompatible to these PHP installations, after setting said options through curl_setopt_array() in PayMaya\Core\HTTPConnection::execute(), as 'TLSv1' is only a valid value if OpenSSL is cURL's back-end. (See https://curl.haxx.se/libcurl/c/CURLOPT_SSL_CIPHER_LIST.html)

In addition, it is best to leave CURLOPT_SSLVERSION alone. See the corresponding entry at https://www.php.net/manual/en/function.curl-setopt.php for a description.

In closing, I highly recommend removing the CURLOPT_SSL_CIPHER_LIST and CURLOPT_SSLVERSION options from PayMaya\Core\HTTPConfig for better compatibility. The API's web server configuration on the other hand will be able to dictate which ciphers to be used on negotiation anyway. See the ssl_protocols, ssl_ciphers, and ssl_prefer_server_ciphers directives for NGINX as examples.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions