curl SSL Error

I barely remember this. It's causing some annoying messages in Apache's error.log, so I'm going to change the URL to something irrelevant and otherwise mess with permissions to get rid of the messages.

Background

This started with a PHP cURL call that worked one month and then did not work two months later, in 2016. cURL started returning precisely boolean false. More specifically, it worked in PHP 5.6.19 / cURL 7.35.0 but not PHP 7.0.8 / cURL 7.47.0.

It had been a long time (never?) since I needed curl_error(). I'd forgotten it existed. Once I used that, I found "Unknown SSL protocol error in connection to www.example.com:443". Then I found:
curl_setopt($ch, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_0);

I arrived at the TLS version in part because when I went to the website I was trying to cURL / fetch in Chrome 55, Chrome gave me a red warning / exclamation point triangle and struck through https in the URL. When I single click on the triangle, I get "Your connection to this site is not secure". When I click on "Details," I get "The connection to this site uses an obsolete protocol (TLS 1.0)..."

Commentary on the Code

The Code

 
	    <?php

define('my_version_CONST'    , '2016/12/31 20:55PM EST');
define('my_TZ_comment_CONST' , ' (GMT / UTC -5 / America/New_York time, no daylight saving)');
define('expected_min_curl_result_strlen_CONST', 3000); // less than the expected size of the HTML page in question

require_once('config.php');

if (!doLive()) exit(0); // explained in article, by Kwynn / Kwynn.com - search Google for HxEn81f4

$url = trim(file_get_contents(path_file_CONST)); // I am going to great lengths not to reveal the URL in question
$ch  = curl_init($url);  unset($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); // return HTML page as string as opposed to straight to stdout

$htRes = curl_exec($ch);

if (PHP_SAPI !== 'cli') header('Content-Type: text/txt'); // if HTTP server rather than command line interface (cli)

if ($htRes === false) echo('1 Error: curl returns nothing (precisely boolean false) - Expected error part 1' . "\n");

$err = curl_error($ch);

// Given URL: https://example.com/
// Expected result: 'Unknown SSL protocol error in connection to example.com:443 '  // note extra space

$expectedErrPrefix = 'Unknown SSL protocol error in connection to ';
$err = trim($err); // because of extra space
if (substr($err, 0, strlen($expectedErrPrefix)) === $expectedErrPrefix) echo('2 Error is as I expected!  Expected error part 2.' . "\n");
if (preg_match('/\:443$/', $err)) echo('3 Expected error part 3 / 3.' . "\n");

curl_setopt($ch, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_0); // or many other options linked from my article
$htRes = curl_exec($ch); curl_close($ch);

$len = strlen($htRes);
if ($len >= expected_min_curl_result_strlen_CONST) echo('4 OK!!! - Page read success!!!' . "\n");

echo('5 snippet version: ' . my_version_CONST . my_TZ_comment_CONST . "\n");
echo('6 executed ' . date('Y-m-d H:i:s') . "\n");

// Generally speaking and if you can get away with it, do NOT close php with a closing tag!!!!
/* ?>  as in do NOT use the close tag to the left!!!! */
// See my commentary (Kwynn / Kwynn.com) in my article.  
// END PHP FILE **********************************

Commentary on closing PHP tags

This goes to a former nemesis of mine--the dreaded "Headers already sent" error. I encountered this on two projects in a row a few years ago, and that error really caused me grief. It acts like a virus.

I may write a whole article on that error one day, explaining my own technical rules that I developed in large part due to that error.

The error is caused when you close a tag and then have a newline, or perhaps even a space--I don't remember, but I think one space after the closing tag will cause you great gravy grief. It never occurred to me that you generally don't need the closing tag. You only need it if you're switching between PHP code and raw output--HTML or text or whatever.

The reason this causes problems is that it confuses the HTTP header (which is usually implicit in PHP programming) versus the HTML body of your output. You're violating HTTP syntax.

The problem is insidious in part because that extra space might be in an include file, and then the effects appear random because there are so many files in the "include" / "require" chain.

It wasn't until I create a Drupal module that I knew that one does not generally have to close the tag. Drupal mentions it in an article on on "Headers already sent". In their Drupal 7 "hello world" module documentation, they specifically advised against closing tags. Given that they are going to Drupal 8, I'm having trouble finding that advice, but they are quite clear about the matter in their coding standards.

Commentary on the my config.php, doLive() and on my coding quirks

As you see from the code, my original version calls the website that has the SSL problem. I want my code to be live on my site for a while to make sure what I've posted works. Then, though, there is no reason to keep abusing that site. Also, the site is for "internal use only," so I don't want to publicize it. Yes, I am aware of the warnings against "security by obscurity," but I also have no control over the site and no direct association with it, so it's not my decision to make. If it were my site, I'd probably include the URL and leave my code live.

I'll eventually (probably in the next few hours) post a ZIP file with all the code, minus the URL.

Coding and other quirks

Yes, I understand that a time of "20:38PM" is weird. It offers redundancy, and I'm trying to make it clear to me. And yes, I'm obsessed with specifying time zones to what I hope is exhaustive clarity. In fact, here are the American (North and South America) time zones, according to PHP.

If you have issues with my coding style in this example, I am not necessarily coding for the ages or doing it like I would professionally. I'm trying to get a few key points "out the door," in hopes I can help others (among other reasons). I'm not holding a PHP coding clinic.

an annoying PHP cURL error / solution and other commentary

Update: 2022

Background

Commentary on the Code

The Code

Expected Output

Commentary on closing PHP tags

Commentary on the my config.php, doLive() and on my coding quirks

Coding and other quirks

Page Info

History

Page ID: