绕过SSL检查

Question

I'm debugging an issue that someone is having in accessing a payment gateway using a PHP plugin. The only way he has been able to avoid a 404 error after clicking the Checkout button is by setting CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST to 0. I know this is bad, but does anyone know why this might be? It seems to be distrusting of the SSL certificate of the payment website...could this just be an issue with his server not trusting certain SSL certificates? The response he is getting from the curl_exec() function is just false when the checks are turned on.

EDIT: So I've seen multiple solutions that say to add something similar to this to my curlopt lines after getting the certificate file:

curl_setopt($ch, CURLOPT_CAINFO, getcwd() . "/CAcerts/certificate.cert");

But what if I'm dealing with a bunch of separate customers that are having this issue? That path won't work for everyone. What can I put instead that will apply to each person?

If I can't put a general line, then where would I tell the person to put their certificate file? This would have to be done by their web hosting service, right?

Answer 1

here is a good answer to your problem: Security consequences of disabling CURLOPT_SSL_VERIFYHOST (libcurl/openssl)

i suggest to analyze the certificate issued by the payment website..
the url used by the php plugin is exactly the same specified in the common name field of the certificate?

If you are sure the certificate provided it's ok, and trusted, You could set the CURLOPT_CAINFO option to trust this certificate and avoid the error: curl_setopt($ch, CURLOPT_CAINFO, 'C:\path\to\curl-ca-bundle.crt');