Unable to connect to WSDL

Question

I was working with older version of OpenSSL(OpenSSL 0.9.8o) and I was forced to use newer OpenSSL 1.0.1e-fips as the result I was unable to connect to WSDL:

Message: SoapClient::SoapClient(): SSL operation failed with code 1. OpenSSL Error messages: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

I need to disable SSL certification check, I tried:

    $client = new SoapClient("https://IP:443/sdk/vimService?wsdl",
        array(
            "trace" => 1,
            "location" => "https://IP:443/sdk/",
            "stream_context" => stream_context_create(
                array(
                    'ssl' => array(
                        'verify_peer'       => false,
                        'allow_self_signed' => true,
                    )
                )
            )
        ) 
    );

`

And it throw:

Message: SoapClient::SoapClient(): Peer certificate CN=localhost.localdom' did not match expected CN=SAME IP AS IN SoapClient()'

Then I added 'peer_name'=> 'localhost.localdom', in stream_context and then it says XML file is empty:

Fatal error: Uncaught SoapFault exception: [Client] looks like we got no XML document

PHP 5.5

Solution 1

Okey, I was able to found issue.

You can avoid this mess using stable PHP 5.5 version

Recently I learned that error: "looks like we got no XML document" is caused because of PHP version - PHP 5.6 in 5.5 working like a charm.

How to fix it in PHP 5.6

1) Remove SSL certificate check in PHP 5.6:

In 5.6 version SSL certification was enabled by default, so if you want to disabled it you must pass context stream:

    "stream_context" => stream_context_create(
        array(
            'ssl' => array(
                'verify_peer'       => false,
                'verify_peer_name'  => false,
            )
        )
    )

2) Deleted ?wsdl and added .wsdl instead (with ?wsdl, it didn't worke for me)

<?php

$client = new SoapClient("https://IP:443/sdk/vimService.wsdl",
    array(
        "trace" => 1,
        "location" => "https://IP:443/sdk/",
        'exceptions' => 1,
        "stream_context" => stream_context_create(
            array(
                'ssl' => array(
                    'verify_peer'       => false,
                    'verify_peer_name'  => false,
                )
            )
        )
    ) 
);


$soapmsg["_this"] = array( "_" => "ServiceInstance", "type" => "ServiceInstance");

$result = $client->RetrieveServiceContent($soapmsg);
$ServiceContent = $result->returnval;

$soapmsg = NULL;
$soapmsg["_this"] = $ServiceContent->sessionManager;
$soapmsg["userName"] = "USERNAME";
$soapmsg["password"] = "PASSWORD";

$result = $client->Login($soapmsg);
$UserSession = $result->returnval;

echo "User, " . $UserSession->userName . ", successfully logged in!\n";

$soapmsg = NULL;
$soapmsg["_this"] = $ServiceContent->sessionManager;
$result = $client->Logout($soapmsg);

Solution 2

In my case stream_context_create didn't worked.
So I download this file here : https://curl.haxx.se/ca/cacert.pem

and placed it in my localhost as : F:\xampp\apache\cert.pem and gave the same path for openssl.cafile=F:\xampp\apache\cert.pem in my phpini

This made the localhost to acquire certificate and things worked great...!! Posting this in case this may help some one going through my situation.

Solution 3

In my case was needed to add the crypt_method

"stream_context" => stream_context_create(
        array(
            'ssl' => array(
                'verify_peer'       => true,
                'verify_peer_name'  => true,
                'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT
            )
        )
    )

Comments

[Zoltan Fedor]

I had the same issue using the Salesforce PHP Toolkit (developer.salesforce.com/page/…) when upgrading to PHP 5.6, but this has solved it. Thanks!

[Oleg Abrazhaev]

I had the same bug with ubuntu 14.10 and php5.6.9 1) - helped me, the best answer!

[kta]

Adding ssl params solves my problem "stream_context" => stream_context_create( array( 'ssl' => array( 'verify_peer' => false, 'verify_peer_name' => false, ) ) )

[Manic Depression]

Indeed, this is really good solution for localhost testing app.