php - 使用 PHP 和证书作为身份验证连接到 FTPS

Question

我很难建立与 FTPS 的连接。

我应该使用 SSL/TLS 和 AUTH(明确标准)进行连接。我有一个服务器地址和一个端口 (:60000) 和来自服务器所有者的公钥以及我自己的证书。

谷歌搜索后，我认为 curl 是我的最佳选择，但我真的不知道该使用哪些 curl 选项。

有没有人有关于将文件连接并上传/下载到此类 FTPS 的代码片段的工作示例？

此页面有一些信息 http://php.net/manual/en/function.curl-setopt.php例如 dong 同样的想法，但使用用户名/密码

$username = 'username';
$password = 'password';
$url = 'example.com';
$ftp_server = "ftp://" . $username . ":" . $password . "@" . $url;

echo "Starting CURL.\n";
$ch = curl_init();
echo "Set CURL URL.\n";

//curl FTP
curl_setopt($ch, CURLOPT_URL, $ftp_server);

//For Debugging
//curl_setopt($ch, CURLOPT_VERBOSE, TRUE);   

//SSL Settings
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
curl_setopt($ch, CURLOPT_FTP_SSL, CURLFTPSSL_TRY);

//List FTP files and directories
curl_setopt($ch, CURLOPT_FTPLISTONLY, TRUE);

//Output to curl_exec
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

echo "Executing CURL.\n";
$output = curl_exec($ch);
curl_close($ch);
echo "Closing CURL.\n";
echo $output . "\n";
$files = explode("\n", $output);
print_r($files);

关于如何使用证书的任何想法？

提前致谢!

Answer 1

我知道响应晚了，但我也一直在为此苦苦挣扎，下面的两段代码最终对我有用，所以即使对你来说为时已晚，也许它会对其他人有所帮助。在我的例子中，我只需要用 CA 证书验证对等点，所以如果你需要用对等点验证你自己(当然除了用户/密码之外)，你可能需要集成下面的第三个代码块。

正在下载(仅限CA证书)

$ftp_server = 'ftps://YOUR-SERVER-NAME/';
$ftp_user = 'FTP-USER-NAME';
$ftp_password = 'FTP-PASSWORD';

$ftp_certificate = 'PATH TO CA CERT'; 
// ...e.g./var/www/certs/ssl-certificate.pub.crt    
$source_file = 'REMOTE-FILE-PATH';
$destination_file = 'LOCAL-FILE-PATH';

$file = fopen($destination_file, 'w');

$ch = curl_init();

curl_setopt($ch, CURLOPT_VERBOSE, TRUE);
curl_setopt($ch, CURLOPT_URL, $ftp_server . $source_file);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_USERPWD, $ftp_user . ':' . $ftp_password);
curl_setopt($ch, CURLOPT_TIMEOUT, 400);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 400);
curl_setopt($ch, CURLOPT_FILE, $file);

//SSL
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, CURLOPT_CAINFO, $ftp_certificate);
curl_setopt($ch, CURLOPT_FTP_SSL, CURLFTPSSL_ALL);
curl_setopt($ch, CURLOPT_FTPSSLAUTH, CURLFTPAUTH_SSL);

curl_exec($ch);
$error_no = curl_errno($ch);
$error_msg = curl_error($ch);
curl_close ($ch);
if ($error_no == 0) {
    $msg = 'File downloaded succesfully.';
} else {
    $msg = 'File download error:' . $error_msg . ' | ' . $error_no;
}
fclose($file);
echo $msg;

---

正在上传(仅限CA证书)

$ftp_server = 'ftps://YOUR-SERVER-NAME/';
$ftp_user = 'FTP-USER-NAME';
$ftp_password = 'FTP-PASSWORD';

$ftp_certificate = 'PATH TO CA CERT'; 
// ...e.g./var/www/certs/ssl-certificate.pub.crt    
$source_file = 'LOCAL-FILE-PATH';
$destination_file = 'REMOTE-FILE-PATH';

$file = fopen($source_file, 'r');

$ch = curl_init();

curl_setopt($ch, CURLOPT_VERBOSE, TRUE);
curl_setopt($ch, CURLOPT_URL, $ftp_server . $destination_file);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_USERPWD, $ftp_user . ':' . $ftp_password);
curl_setopt($ch, CURLOPT_TIMEOUT, 400);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 400);

curl_setopt($ch, CURLOPT_UPLOAD, 1);
curl_setopt($ch, CURLOPT_INFILE, $file);
curl_setopt($ch, CURLOPT_INFILESIZE, filesize($source_file));

//SSL stuff
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, CURLOPT_CAINFO, $ftp_certificate);

curl_setopt($ch, CURLOPT_FTP_SSL, CURLFTPSSL_ALL);
curl_setopt($ch, CURLOPT_FTPSSLAUTH, CURLFTPAUTH_SSL);

$upload_result = curl_exec($ch);
$upload_info = curl_getinfo($ch);
$error_no = curl_errno($ch);
$error_msg = curl_error($ch);
curl_close ($ch);
if ($error_no == 0) {
    $msg = 'File uploaded succesfully.';
} else {
    $msg = 'File upload error:' . $error_msg . ' | ' . $error_no;
}

fclose($file);
echo $msg . '(' . filesize($source_file) . ')';

您可以像这样检查响应代码，例如:

if ($upload_info['http_code'] == '226') {...}

---

添加公钥/私钥(在curl_exec之前添加)

// A private SSL key.
// If your key file has a password, you will need to set
// this with CURLOPT_SSLKEYPASSWD
curl_setopt($ch, CURLOPT_SSLKEY, $keyFile);

// A PEM formatted certificate- with CURLOPT_SSLCERTTYPE
// you could also use DER or ENG formats
curl_setopt($ch, CURLOPT_SSLCERT, $certFile);
curl_setopt($ch, CURLOPT_SSLCERTPASSWD, $certPass);

当然，如果文件很大且传输速度很慢，您可能不得不摆弄 PHP、Apache 和 nginx 中的超时限制，就像我在遇到麻烦的 Plesk 安装时所做的那样。