记录那些踩过的坑 - NSS error -5938 (PR_END_OF_FILE_ERROR)， curl: (35) Encountered end of file

PHP通过curl POST数据到https, 同样的code,在第一个server上没有问题。在第二个server上却一直不成功。

于是打开debug mode发现了下面的log.

code:

-------------------------------------------------------------

   try {
      #1. init curl
      $ch = curl_init();

      #2. Set option
      curl_setopt($ch, CURLOPT_URL, $url);
      curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
      curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
      curl_setopt($ch, CURLOPT_POST, 1);
      curl_setopt($ch, CURLOPT_POSTFIELDS, $postFields);

      if($headerFields != NULL){
        curl_setopt($ch, CURLOPT_HTTPHEADER, $headerFields);
      }

      curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
      curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
      curl_setopt($ch, CURLOPT_SSLCERT, self::CLIENT_CRT);

      curl_setopt($ch, CURLOPT_SSLKEY, self::CLIENT_KEY);

     curl_setopt($ch, CURLOPT_VERBOSE, 1); #debug mode

     curl_setopt($ch, CURLOPT_STDERR,fopen("/tmp/curl_ssl.log", "w+")); #debug mode, print log to: /tmp/curl_ssl.log

      #3. execute curl and get response
      $result = curl_exec($ch); 
      Log::info("Info: HttpMethod::http_post - Get Result:".$result);

      $rlt_array = json_decode($result, true);
      $rsp_array = curl_getinfo($ch); 

      Log::info($rsp_array);

      #4. release curl
      curl_close($ch);
    } catch (\Exception $e) {

        Log::info($e);

    }
-------------------------------------------------------------

/tmp/curl_ssl.log:

-------------------------------------------------------------

* About to connect() to 180.101.147.89 port8743 (#1)

*  Trying 180.101.147.89...

* Connected to 180.101.147.89(180.101.147.89) port 8743 (#1)

* NSS error -5938(PR_END_OF_FILE_ERROR)

* Encountered end of file

* Closing connection 1

-------------------------------------------------------------

发现用curl命令调用https遇到错误：

-------------------------------------------------------------

[root@localhost ~]# curl https://*.*.*.*

curl: (35) Encountered end of file

-------------------------------------------------------------

原因：需要强制指定ssl版本。例如：

 -2, --sslv2         Use SSLv2 (SSL)
 -3, --sslv3         Use SSLv3 (SSL)
     --ssl-allow-beast Allow security flaw to improve interop (SSL)
     --stderr FILE   Where to redirect stderr. - means stdout
     --tcp-nodelay   Use the TCP_NODELAY option
 -t, --telnet-option OPT=VAL  Set telnet option
     --tftp-blksize VALUE  Set TFTP BLKSIZE option (must be >512)
 -z, --time-cond TIME  Transfer based on a time condition
 -1, --tlsv1         Use => TLSv1 (SSL)
     --tlsv1.0       Use TLSv1.0 (SSL)
     --tlsv1.1       Use TLSv1.1 (SSL)
     --tlsv1.2       Use TLSv1.2 (SSL)

添加参数--tlsv1解决问题:

[root@localhost conf.d]# curl --tlsv1 https://*.*.*.*

curl: (60) Peer's certificate issuer hasbeen marked as not trusted by the user.

More details here: http://curl.haxx.se/docs/sslcerts.html

 ......

参考：http://php.net/manual/en/function.curl-setopt.php

选择需要的ssl版本：

CURLOPT_SSLVERSION

One of CURL_SSLVERSION_DEFAULT (0), CURL_SSLVERSION_TLSv1 (1),CURL_SSLVERSION_SSLv2 (2), CURL_SSLVERSION_SSLv3 (3), CURL_SSLVERSION_TLSv1_0(4), CURL_SSLVERSION_TLSv1_1 (5) or CURL_SSLVERSION_TLSv1_2 (6).

这里由于是用的tlsv1，于是添加下面一句到code中，问题解决：

curl_setopt($ch, CURLOPT_SSLVERSION, 1);