贝宝 SSL 错误

Question

我尝试使用包paypal/rest-api-sample-app-php 来确定问题是否出在我的代码中。显然不是……所以我尝试：

curl -v https://api.sandbox.paypal.com/v1/oauth2/token

我收到了一个错误。这是我在我的 cmd 上运行的：

C:\Users\Eliya Cohen>curl -v https://api.sandbox.paypal.com/v1/oauth2/token
*   Trying 173.0.82.78...
* Connected to api.sandbox.paypal.com (173.0.82.78) port 443 (#0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: C:\Program Files\cURL\bin\curl-ca-bundle.crt
CApath: none
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, Server hello (2):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
* TLSv1.2 (OUT), TLS alert, Client hello (1):
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.

这是我的curl-ca-bundle.crt 文件：http://pastebin.com/RZ6EaxTF

Answer 1

我遇到了同样的错误，但是在tomcat服务器中启用ssl后，它就消失了。返回您应该使用的网址

Answer 2

您在 pastebin 中提供的证书文件包含必要的根证书。这意味着您要么不使用 pastebin 中给出的 CA 文件，要么在与 paypal 的连接中有一些中间盒来进行 SSL 拦截。这可能是中间人攻击，但更常见的是公司内部的 SSL 拦截，以便公司可以分析加密流量中的恶意软件。如果您在公司内部，请咨询您的网络管理员。