php - Paypal SSL 错误

Question

我尝试使用包 paypal/rest-api-sample-app-php以确保问题是否出在我的代码中。显然不是..所以我尝试:

curl -v https://api.sandbox.paypal.com/v1/oauth2/token

然后我收到一个错误。这是我在 cmd 上运行的:

C:\Users\Eliya Cohen>curl -v https://api.sandbox.paypal.com/v1/oauth2/token
*   Trying 173.0.82.78...
* Connected to api.sandbox.paypal.com (173.0.82.78) port 443 (#0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: C:\Program Files\cURL\bin\curl-ca-bundle.crt
CApath: none
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, Server hello (2):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
* TLSv1.2 (OUT), TLS alert, Client hello (1):
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.

这是我的 curl-ca-bundle.crt 文件:http://pastebin.com/RZ6EaxTF

Answer 1

您在 pastebin 中提供的证书文件包含必要的根证书。这意味着您要么不使用 pastebin 中给出的 CA 文件，要么在您与 paypal 的连接中有一些中间件进行 SSL 拦截。这可能是中间人攻击，但更常见的是公司内部的 SSL 拦截，以便公司可以分析加密流量中的恶意软件。如果您在公司内部，请咨询您的网络管理员。