• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

SSL / TLS Socket Server PHP4

T

tino

n00b
Joined
Jun 9, 2008
Messages
30
Hi everyone,

I have google'd this quite extensively and it doesn't appear to be possible, however I thought I would ask here just to confirm.

I have a requirement to create a Socket Server that will server various web pages, however it needs to be compliant with PHP 4.3.x at a minimum, unfortunately this limits the options I have available for the SSL / TLS connection.

Is it possible to do this with PHP4 ? Currently I am using the Socket Functions library. Which doesn't have the same options as the Stream Sockets Functions , which I believe can do this quite easily, the only issue being they are mainly PHP 5 only functions which is not suitable for this project.

Any help or advise would be appreciated.

It has to be written in PHP aswell. So please don't suggest python, C or java.
 
According to the PHP manual, the socket and openssl libraries work just fine with PHP Versions >=4.1.0. What exactly are you attempting to accomplish? If you have PHP, then you should have Apache, which already serves web pages just fine over TLS/SSL.
 
JosiahBradley said:
According to the PHP manual, the socket and openssl libraries work just fine with PHP Versions >=4.1.0. What exactly are you attempting to accomplish? If you have PHP, then you should have Apache, which already serves web pages just fine over TLS/SSL.
Click to expand...

Thanks for the response.

I want to remove the need to have apache installed and to just use php to server all webpages.

I have got it working correctly over http using the socket functions available within php4 however I can't seem to get it working correctly using https.
 
tino said:
I want to remove the need to have apache installed and to just use php to server all webpages.
Click to expand...

Why? If Apache is too heavy, use a smaller server like Lighty. What do you hope to gain by eliminating the HTTP daemon?
 
CEpeep said:
Why? If Apache is too heavy, use a smaller server like Lighty. What do you hope to gain by eliminating the HTTP daemon?
Click to expand...

Due to the underlying infrastructure a php socket server is the preferred option.

I however think its only going to be possible using php5.
 
php is a compile on execution scripting language that should be run by a HTTP daemon, while daemon php apps are possible until you explain specifically why php is the only programming language you can use I would strongly recommend against using it for your needs.
 
carbontwelve said:
php is a compile on execution scripting language that should be run by a HTTP daemon, while daemon php apps are possible until you explain specifically why php is the only programming language you can use I would strongly recommend against using it for your needs.
Click to expand...

I understand all the foibles and infrastructure issues related with using php, however it a requirement that has been placed upon me by a client, and I did it more as a proof of concept. Everything else works as expected, baring the https.
 
It's obviously possible. However that doesn't mean it is practical ;)

One way to do it would obviously be to implement ssl from scratch in pure php but you'd have to be a masochist to actually do that ;). So realistically you need to find some way of calling an existing ssl library.

What OS will this be running on? Is installing php extensions possible?
 
tino said:
Due to the underlying infrastructure a php socket server is the preferred option.

I however think its only going to be possible using php5.
Click to expand...

So you're going to use the php CLI to emulate exactly what apache + mod_php5 give you??
Please carefully consider what you are doing, because you are about to make one insecure application doing it this way. You can implement SSL using the provided openSSL libs, but how on earth are you doing this client side? When the browser fetches a page over 443 it's expecting that an actual web server is on the other end, not just a php daemon with hand coded SSL routines, which there are many, with different support and algos for each client browser. You also have to worry about the 3 most commonly used variants for SSL, TLSv1.0 SSLv3.0 and fallback logic for SSLv2. Then you need to support at least RC4, AES128, AES 256 with all different block models and combat renegotiation in a secure fashion for SSLv3-.

Just my 2 cents, but please note that this is my current occupation as a PHP web developer and hyper paranoid security user. As others have noted, going with lighttp + openssl would be a much more secure and easier to implement option.
 
Hi everyone,

Many thanks for all the responses.

I understand all the pitfalls, problems and the fact there are many easier solutions out there. However if we all took the easy route we would never get anywhere in life... Maybe the wrong analysis for this problem.

Anyway, its running on Linux, and yes I am going to implement what apache + mod_php4 give me within the php cli.

I personally think there is to much to do, however I thought it would be worth a try. An considering the sticking point is the SSL part its not to bad.
 
You must log in or register to reply here.
Back
Top