symfony - 来自 Symfony2 Controller 的 SSL 错误

Question

如何从本地主机上的 Symfony2 Controller 调用 https (SSL) url？我正在使用 Debril RssAtomBundle 包来调用仅在 https 上的 Google Blogger API，我不确定如何从本地主机实现此目的。我的 Google Blogger API 调用肯定有效，因为 URL 在浏览器中返回了预期的博客内容。我也想确保代码是安全的。

我在调用 URL 时得到的错误是:

SSL证书问题，验证CA证书是否OK

Answer 1

The error I get when calling the URL is:

SSL certificate problem, verify that the CA cert is OK

听起来你需要使用 Google Internet Authority G2作为信任 anchor 。对于 *.blogger.com，Google 的 CA 似乎也由 GeoTrust Global CA 签署:

$ openssl s_client -connect blogger.com:443
CONNECTED(00000003)
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=*.blogger.com
   i:/C=US/O=Google Inc/CN=Google Internet Authority G2
 1 s:/C=US/O=Google Inc/CN=Google Internet Authority G2
   i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
   i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
 ...

Start Time: 1407035752
Timeout   : 300 (sec)
Verify return code: 20 (unable to get local issuer certificate)

---

一旦您使用 Google CA 作为信任 anchor ，它将验证 OK(注意添加了 -CAfile 选项):

$ openssl s_client -connect blogger.com:443 -CAfile GIAG2.pem 
CONNECTED(00000003)
depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority
verify return:1
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify return:1
depth=1 C = US, O = Google Inc, CN = Google Internet Authority G2
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google Inc, CN = *.blogger.com
verify return:1
...

Start Time: 1407035642
Timeout   : 300 (sec)
Verify return code: 0 (ok)

提示:下载 GIAG2.crt 后，您需要使用 openssl x509 -in GIAG2.crt -inform DER -out GIAG2 将其从 ASN.1/DER 转换为 PEM .pem -outform PEM.