Symfony HWIOAuthBundle，SSL 证书

Question

当我使用 Symfony2 HWIOAuthBundle 将我的网络连接到 facebook 时出现此错误

SSL certificate problem: unable to get local issuer certificate

我在堆栈上找到了这个 url 下的解析方式: Symfony HWIOAuthBundle, how to configure cURL?

但是当我被添加时:

http_client:
    verify_peer: false

我收到另一个错误:

No property defined for entity for resource owner 'facebook'.

我不知道这是怎么回事。

配置/配置.yml

imports:
    - { resource: parameters.yml }
    - { resource: security.yml }

framework:
    #esi:             ~
    translator:      { fallback: "pl" }
    secret:          "%secret%"
    router:
        resource: "%kernel.root_dir%/config/routing.yml"
        strict_requirements: ~
    form:            ~
    csrf_protection: ~
    validation:      { enable_annotations: true }
    templating:
        engines: ['twig']
        #assets_version: SomeVersionScheme
    default_locale:  "%locale%"
    trusted_hosts:   ~
    trusted_proxies: ~
    session:
        # handler_id set to null will use default session handler from php.ini
        handler_id:  ~
    fragments:       ~
    http_method_override: true

# Twig Configuration
twig:
    debug:            "%kernel.debug%"
    strict_variables: "%kernel.debug%"

# Assetic Configuration
assetic:
    debug:          "%kernel.debug%"
    use_controller: false
    bundles:        [ ]
    #java: /usr/bin/java
    filters:
        cssrewrite: ~
        #closure:
        #    jar: "%kernel.root_dir%/Resources/java/compiler.jar"
        #yui_css:
        #    jar: "%kernel.root_dir%/Resources/java/yuicompressor-2.4.7.jar"
        lessphp:
            file: %kernel.root_dir%/../vendor/leafo/lessphp/lessc.inc.php
            apply_to: "\.less$"
# Doctrine Configuration
doctrine:
    dbal:
        driver:   "%database_driver%"
        host:     "%database_host%"
        port:     "%database_port%"
        dbname:   "%database_name%"
        user:     "%database_user%"
        password: "%database_password%"
        charset:  UTF8
        # if using pdo_sqlite as your database driver, add the path in parameters.yml
        # e.g. database_path: "%kernel.root_dir%/data/data.db3"
        # path:     "%database_path%"

    orm:
        auto_generate_proxy_classes: "%kernel.debug%"
        auto_mapping: true

# Swiftmailer Configuration
swiftmailer:
    transport: "%mailer_transport%"
    host:      "%mailer_host%"
    username:  "%mailer_user%"
    password:  "%mailer_password%"
    spool:     { type: memory }

hwi_oauth:
    resource_owners:
        facebook:
            type:                facebook
            client_id:           xxx
            client_secret:       xxx
        google:
            type:                google
            client_id:           xxx
            client_secret:       xxx
        github:
            type:                github
            client_id:           xxx
            client_secret:       xxx
    # name of the firewall in which this bundle is active, this setting MUST be set
    firewall_name: secured_area
    http_client:
        verify_peer: false

services:
    my.oauth_aware.user_provider.service:
        class: HWI\Bundle\OAuthBundle\Security\Core\User\FOSUBUserProvider
        arguments:
            userManager: "@fos_user.user_manager"
            properties: ["pass properties as array"]

fos_user:
    db_driver: orm # other valid values are 'mongodb', 'couchdb' and 'propel'
    firewall_name: main
    user_class: Acme\DemoBundle\Entity\User

braincrafted_bootstrap:
    less_filter: lessphp

Answer 1

http_client:
   verify_peer: false

坏主意。

to connect my web with facebook...

Facebook 使用 DigiCert 作为其 CA:

$ openssl s_client -connect facebook.com:443
CONNECTED(00000003)
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance CA-3
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/C=US/ST=CA/L=Menlo Park/O=Facebook, Inc./CN=*.facebook.com
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance CA-3
 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance CA-3
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
---
Server certificate
...

如果您获取所需的 CA 文件并在您的请求中使用它，那就更好了。您可以在 DigiCert Root Certificates 找到 DigiCert High Assurance EV Root CA .

如果您不打算正确使用 PKIX，您还不如使用匿名协议(protocol)，例如匿名 Diffie-Hellman (ADH) 或匿名椭圆曲线 Diffie-Hellman (AECDH)。它将节省一些带宽，因为服务器不需要发送证书(因为您没有验证它)。

---

另见 SSL certificate problem #368在 HWIOAuthBundle Github 上.