Yosemite and SSL Certificate Verification Failed with cURL

Let's say you're a developer, like myself, and you have just updated to Apple's latest operating system (Yosemite or 10.10) and all of a sudden the Twilio PHP SDK stops working. And, it gives you an error something like this:

SSL: certificate verification failed (result: 5)

The problem disappears when you comment out the CURLOPT_CAINFO option, which makes it a bit more confusing. In other words, you can't use your own CA bundle/file. Others have also noted that it only really happens with certain certificate types, like wild-card domains (e.g., api.twilio.com doesn't work, for example).

Well, it seems to be a bug on the specific version of cURL, version 7.37.1, that Apple has bundled with their operating system. Version 7.37.0 and the latest version of cURL both work fine.

Check this out for all the details: http://sourceforge.net/p/curl/bugs/1404/

I haven't found a good way to fix it yet, myself, but the above link does offer some suggestions.

Error starting Apache (httpd) - Configuration files not readable

Here is an interesting issue I ran into today while setting up a new VM. I had copied the Apache conf file and SSL/TLS certificate files onto my new server as root using wget. All of the file's ownerships and permissions looked right and I thought I was ready to go. Then I ran into these two misleading errors:

Could not open configuration file /etc/httpd/conf.d/ssl.conf: Permission denied

and

SSLCertificateFile: file '/etc/pki/tls/certs/mydomain.com.crt' does not exist or is empty

Contrary to what Apache reported, the ssl.conf file did have the correct permissions and the crt file did exist and had contents. So what gives? Our trusty SELinux friend is at it again, it seems. Because I had copied these files in from somewhere else, SELinux was detecting something off. It is an easy fix, though. Just run this command, specifing each of the files above:

restorecon -v /etc/httpd/conf.d/ssl.conf

and

restorecon -Rv /etc/pki/tls/certs/

That -R is for "recursive" and it means I want it to do the whole directory.

After fixing up the SELinux permissions for these files I brought in, everything started up just fine!

Installing Intermediate CA with cPanel

When I saw that the VeriSign EV SSL / TLS certificates required an intermediate CA to be installed, I was worried it was going to be a long and painful process. Well, turns out it is super easy to install.

It seems that some of the modern browsers have no problem when the intermediate CA is not installed, but older ones, on the other hand, don't like it. So, here is how you make your cert work on most browsers.

First, copy the appropriate intermediate CA root bundle from VeriSign. I had a standard EV SSL, so I used the first cert on this page.

Now, log in to cPanel and click on "SSL/TLS Manager" > "Activate SSL on Your Web Site (HTTPS)". Use the drop-down box to select your domain and the domain's certificate should show up (the one you installed at an earlier time, or google "install SSL certificate with cPanel"). Then, you'll see an extra text box at the bottom called "Ca Bundle (CABUNDLE)." Just paste the intermediate CA there and click "Install." Yep, it's that easy.

Wildcard SSL on WHM and cPanel

I had the task of implementing a wildcard SSL for a client the other day. I search the web for info on doing this with WHM and cPanel and got a host of wild answers that made it sound difficult to impossible. When I got done, I was surprised by how easy it was. Here is what I did..

By the way, just as a disclaimer, this is from memory. If you have any feedback, let me know in the comments.

1. Create an account for *.example.com (you must have a dedicated IP for the account for example.com)
   
2. Generate private keys (Log into cPanel > SSL/TLS Manager > Private Keys (KEY)) for the domain *.example.com
   
3. Generate a signing request (cPanel > SSL/TLS Manager > Certificate Signing Requests (CSR)) for the domain *.example.com
   
4. Go to your favorite certificate issuer (RapidSSL, for instance) and get your certificate using the CSR you just created
   
5. Upload your new certificate from your issuer (cPanel > SSL/TLS Manager > Certificates (CRT)) by pasting it in the box
   
6. Install & enable the new certificate (cPanel > SSL/TLS Manager > Activate SSL on Your Web Site (HTTPS)) for example.com (it is missing the * but this is ok)
   
7. Everything should be working now, so try it by going to https://example.com/
   
8. Create a * sub-domain so that all sub-domains will work (cPanel > Subdomains) directing them to the document root of public_html
   
9. Create a folder in public_html for each sub-domain you want to use
   
10. Add these lines to your .htaccess file to rewrite the URL:
    
    # This line should only be in the file once, at the top
    RewriteEngine On
    
    RewriteCond %{HTTP_HOST} ^mysubdomain\.example\.com$
    RewriteCond %{REQUEST_URI} !^/mysubdomain/
    RewriteRule ^(.*) mysubdomain/$1 [L]
    
    

And that should be it. Like I said, I am doing this from memory. But, this is the general outline to getting a wildcard SSL working on cPanel. It does work and is not that hard to get going, contrary to many other posts. If I missed something or did a step wrong, please let me know so I can update this post.

Peace!

cURL and SSL

cURL is a nice little extension to PHP. You can read an intro here.

I use cURL a lot. It seems that do a lot of web applications that connect to other servers for transactions (like payment gateways). You can do SSL or HTTPS requests to other web hosts without validating their certificates but you leave yourself open to man-in-the-middle attacks. While this seems unlikely if you are running out of a data center, checking the certificate validity is too easy to skip.

The one thing that you must do for this to work is tell cURL where the CA-bundle (or CURLOPT_CAINFO) is located. I am running CENTOS 5.4 and found CA info at "/etc/pki/tls/certs/ca-bundle.crt". I can enable this with the following two lines added before curl_exec();

 curl_setopt($ch, CURLOPT_CAINFO, "/etc/pki/tls/certs/ca-bundle.crt");
 curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 1);