CODEWITHSUNDEEP
phpsoapsoap-clienttls1.2php-5.5
Brett
Brett

Reputation: 20049

Making sure SoapClient is sending TLS 1.2 requests in PHP 5.5

We have a site on an old codebase using PHP 5.5 (for now) and one of our integrations we interface with using SoapClient has told us they will be disabling usage of TLS < 1.2 shortly.

Currently our connections are as simple as:

$client = new SoapClient($soap_url);

What do we have to do to make sure only TLS 1.2 requests are sent? I found this answer, but I'm not entirely sure if this still applies to our situation; additionally, not sure we should be forcing Soap 1.1 either?

What are the requirements on our end to make sure we send TLS 1.2 requests?

Upvotes: 1

Views: 4761

Answers (1)

ficuscr
ficuscr

Reputation: 7054

When negotiating the connection with the server, your TLS library, let's assume openSSL, is going to tell the server what your maximum supported version is. The server will then choose a version that it, and the client both support. So, assuming your client system supports TLS1.2 there is probably no action required on your part.

TLS 1.2 support was added to OpenSSL in 1.0.1. If you are on el6 or newer and update your packages you should be fine. Check your version like so:

# openssl version
> OpenSSL 1.0.2k-fips  26 Jan 2017

You can check what protocols/ciphers a server supports with this nmap command:

 nmap --script ssl-enum-ciphers -p 443 stackoverflow.com

Now, if you want to test a failure when using TLS1.1, or force a cipher or something, you will need to use PHP's stream_context_create.

With the code below you can force use of TLS1.2 by setting the crypto_method to STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT. Or, perhaps more useful towards what you are asking, you could test the failure when forcing use of STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT. 

<?php
$options = ['trace' => 1,
            'soap_version' => SOAP_1_2,
            'exceptions' => true,
            'location' => 'https://stackoverflow.com/foo',
            'uri' => "https://stackoverflow.com/bar",
            'stream_context' => stream_context_create([
                'ssl'=> [
                    'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT,
                    'ciphers' => 'SHA256'                        
                 ]
             ])];

$client = new SoapClient(null, $options);

try {
    $response = $client->getFoo();    
} catch (\Exception $e){    
    var_dump($client->__getLastRequest());
    var_dump($client->__getLastResponse());
    throw $e;
}


//OR, an even easier test with out a Soap Client...
$opts = [
         'ssl'=> [
             'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT,
             'ciphers' => 'SHA256',
             'verify_peer' => false,
             'verify_peer_name' => false
         ]
     ];

$context = stream_context_create($opts);
$fp = fopen('https://stackoverflow.com', 'r', false, $context);

If things work with 1.2 and you can generate an error forcing say 1.1 then you can be pretty confident things are setup fine. Errors would be along the lines of:

Warning: fopen(): SSL operation failed with code 1. OpenSSL Error messages: error:140830B5:SSL routines:ssl3_client_hello:no ciphers available

fopen(): Failed to enable crypto

When talking about SOAP version 1.1 vs 1.2 those are just different W3C standards for the Simple Object Access Protocol. More on some of the differences can be found here.

I will just say in closing I've not tested this in PHP 5.5, that is such an old version that these days I don't have an easy way to spin it up. Think this would all still be applicable however.

Upvotes: 2

Related Questions