PHP cURL SSL Peer Verification Disabled

What it is

The PHP application disables SSL peer verification in cURL requests by setting CURLOPT_SSL_VERIFYPEER to false, making it vulnerable to man-in-the-middle attacks. This configuration bypasses certificate validation, allowing attackers to intercept and manipulate HTTPS communications.

// Vulnerable: Disabled SSL peer verification
function makeHttpsRequest($url, $data) {
    $ch = curl_init();
    
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    
    // Dangerous: Disables SSL certificate verification
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
    
    $response = curl_exec($ch);
    
    if (curl_error($ch)) {
        throw new Exception('cURL error: ' . curl_error($ch));
    }
    
    curl_close($ch);
    return $response;
}

$result = makeHttpsRequest('https://api.example.com/data', $postData);

// Secure: Proper SSL verification enabled
function makeSecureHttpsRequest($url, $data) {
    $ch = curl_init();
    
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    
    // Secure: Enable SSL verification
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
    
    // Set CA certificate bundle
    curl_setopt($ch, CURLOPT_CAINFO, '/path/to/cacert.pem');
    
    // Additional security options
    curl_setopt($ch, CURLOPT_PROTOCOLS, CURLPROTO_HTTPS);
    curl_setopt($ch, CURLOPT_REDIR_PROTOCOLS, CURLPROTO_HTTPS);
    curl_setopt($ch, CURLOPT_TIMEOUT, 30);
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 10);
    
    $response = curl_exec($ch);
    
    if (curl_error($ch)) {
        $error = curl_error($ch);
        curl_close($ch);
        throw new Exception('Secure cURL request failed: ' . $error);
    }
    
    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    
    if ($httpCode !== 200) {
        throw new Exception('HTTP request failed with status: ' . $httpCode);
    }
    
    return $response;
}

try {
    $result = makeSecureHttpsRequest('https://api.example.com/data', $postData);
} catch (Exception $e) {
    error_log('HTTPS request error: ' . $e->getMessage());
    // Handle error appropriately
}

Why it happens

Developers encounter SSL certificate verification errors during cURL requests—typically SSL certificate problem: unable to get local issuer certificate or SSL certificate problem: self signed certificate in certificate chain—and immediately disable verification with curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); to make the error disappear and allow the HTTP request to proceed. This quick-fix approach treats the SSL error as an impediment to functionality rather than a critical security warning that the certificate chain cannot be validated. The pattern often appears when integrating with third-party APIs during rapid development cycles where developers prioritize getting the integration working over understanding certificate validation. Stack Overflow searches for SSL certificate errors commonly suggest disabling verification as the first solution, which developers copy without understanding security implications. The disabled verification setting gets committed to version control, passes code review unnoticed, and deploys to production where it leaves HTTPS connections vulnerable to man-in-the-middle attacks. Attackers positioned between the PHP application and the API endpoint can intercept traffic, present a fraudulent certificate (which the application accepts without verification), decrypt sensitive data in transit, modify API responses, or capture authentication credentials.

Fixes

Related Vulnerabilities