4 Mar
2015
4 Mar
'15
11:04 a.m.
I'd like to have my own client written in PHP talk to FRED.
I was given separate CRT and KEY files by TZNIC. I've combined this
into a single PEM file with:
cat posix.key posix.crt > /tmp/tznic.pem
I can then successfully get the "Welcome" XML from FRED at TZNIC with:
openssl s_client -connect fred.tznic.or.tz:700 -cert /tmp/tznic.pem
This shows as a self-signed certificate (as expected).
(verify error:num=18:self signed certificate)
The combining of the crt and key is because php seems to want a combined
PEM certificate...
Then - I try connecting with a VERY stripped down PHP script....
(attached)...
The core of which is:
$ip="fred.tznic.or.tz";
$port=700;
$cert="/tmp/tznic.pem";
$context = stream_context_create();
$result = stream_context_set_option($context, 'ssl', 'local_cert',
$cert);
$result = stream_context_set_option($context, 'ssl', 'verify_peer',
false);
$result = stream_context_set_option($context, 'ssl', 'verify_host',
false);
$result = stream_context_set_option($context, 'ssl',
'allow_self_signed', true);
$fp = stream_socket_client("tls://$ip:$port", $errno,$errstr, 20,
STREAM_CLIENT_CONNECT, $context);
if(!$fp) echo "CONNECT ERROR: $errstr ($errno)\n";
else // read the packet......
The "stream_socket_client" simply times out.
What am I doing wrong???
Almost the same code works for: (ie changing machines, ports and Certs)
Central-NIC
ZACR/CO.ZA
CoCCA
The FRED test system at TZNIC is running certificate validation - I'm
assuming its got something to do with that????
I'm using a variety of different versioned PHP's
eg
PHP 5.5.18-pl0-gentoo (cli) (built: Nov 10 2014 22:20:27)
PHP 5.5.21-pl0-gentoo (cli) (built: Feb 6 2015 16:46:22)
PHP 5.4.34-pl0-gentoo (cli) (built: Nov 3 2014 11:10:23)
All do the same thing - timeout.
Is anyone using a PHP based client?? - that would be the start of a
WHMCS plugin for C-Panel (etc).
--
Mark James ELKINS - Posix Systems - (South) Africa
mje(a)posix.co.za Tel: +27.128070590 Cell: +27.826010496
For fast, reliable, low cost Internet in ZA: https://ftth.posix.co.za
5 Mar
5 Mar
noon
There should be many php clients. Mario, your registrar implementation
is in php, isn't it? What is your php epp connect procedure?
Jaromir
On Wed, 2015-03-04 at 12:04 +0200, Mark Elkins wrote:
I'd like to have my own client written in PHP talk
to FRED.
I was given separate CRT and KEY files by TZNIC. I've combined this
into a single PEM file with:
cat posix.key posix.crt > /tmp/tznic.pem
I can then successfully get the "Welcome" XML from FRED at TZNIC with:
openssl s_client -connect fred.tznic.or.tz:700 -cert /tmp/tznic.pem
This shows as a self-signed certificate (as expected).
(verify error:num=18:self signed certificate)
The combining of the crt and key is because php seems to want a combined
PEM certificate...
Then - I try connecting with a VERY stripped down PHP script....
(attached)...
The core of which is:
$ip="fred.tznic.or.tz";
$port=700;
$cert="/tmp/tznic.pem";
$context = stream_context_create();
$result = stream_context_set_option($context, 'ssl', 'local_cert',
$cert);
$result = stream_context_set_option($context, 'ssl', 'verify_peer',
false);
$result = stream_context_set_option($context, 'ssl', 'verify_host',
false);
$result = stream_context_set_option($context, 'ssl',
'allow_self_signed', true);
$fp = stream_socket_client("tls://$ip:$port", $errno,$errstr, 20,
STREAM_CLIENT_CONNECT, $context);
if(!$fp) echo "CONNECT ERROR: $errstr ($errno)\n";
else // read the packet......
The "stream_socket_client" simply times out.
What am I doing wrong???
Almost the same code works for: (ie changing machines, ports and Certs)
Central-NIC
ZACR/CO.ZA
CoCCA
The FRED test system at TZNIC is running certificate validation - I'm
assuming its got something to do with that????
I'm using a variety of different versioned PHP's
eg
PHP 5.5.18-pl0-gentoo (cli) (built: Nov 10 2014 22:20:27)
PHP 5.5.21-pl0-gentoo (cli) (built: Feb 6 2015 16:46:22)
PHP 5.4.34-pl0-gentoo (cli) (built: Nov 3 2014 11:10:23)
All do the same thing - timeout.
Is anyone using a PHP based client?? - that would be the start of a
WHMCS plugin for C-Panel (etc).
_______________________________________________
fred-users mailing list
fred-users(a)lists.nic.cz
https://lists.nic.cz/cgi-bin/mailman/listinfo/fred-users
--
Jaromir Talir
technicky reditel / Chief Technical Officer
-------------------------------------------
CZ.NIC, z.s.p.o. -- .cz domain registry
Milesovska 5, 130 00 Praha 3, Czech Republic
mailto:jaromir.talir@nic.cz http://nic.cz/
sip:jaromir.talir@nic.cz tel:+420.222745107
mob:+420.739632712 fax:+420.222745112
-------------------------------------------
12:13 p.m.
Hello,
we use this working connection:
$ip = '1.2.3.4';
$cert = "/certfile.pem";
$host = "ssl://fredserver:700";
$opts = array();
$opts['socket'] = array('bindto' => $ip . ':0');
$opts['ssl'] = array(
'verify_peer' => false,
'allow_self_signed' => true,
'transport' => 'ssl'
'local_cert' = $cert;
}
$timeout = 30;
$context = stream_context_create($opts);
$socket = stream_socket_client($host, $errno, $errstr, $timeout,
STREAM_CLIENT_CONNECT, $context);
Jaromir Talir napsal(a):
There should be many php clients. Mario, your
registrar implementation
is in php, isn't it? What is your php epp connect procedure?
Jaromir
On Wed, 2015-03-04 at 12:04 +0200, Mark Elkins wrote:
--
S pozdravem, Jan Horak
CEO, Gransy s.r.o.
ICANN Accredited Registrar
I'd like to have my own client written in PHP
talk to FRED.
I was given separate CRT and KEY files by TZNIC. I've combined this
into a single PEM file with:
cat posix.key posix.crt > /tmp/tznic.pem
I can then successfully get the "Welcome" XML from FRED at TZNIC with:
openssl s_client -connect fred.tznic.or.tz:700 -cert /tmp/tznic.pem
This shows as a self-signed certificate (as expected).
(verify error:num=18:self signed certificate)
The combining of the crt and key is because php seems to want a combined
PEM certificate...
Then - I try connecting with a VERY stripped down PHP script....
(attached)...
The core of which is:
$ip="fred.tznic.or.tz";
$port=700;
$cert="/tmp/tznic.pem";
$context = stream_context_create();
$result = stream_context_set_option($context, 'ssl', 'local_cert',
$cert);
$result = stream_context_set_option($context, 'ssl', 'verify_peer',
false);
$result = stream_context_set_option($context, 'ssl', 'verify_host',
false);
$result = stream_context_set_option($context, 'ssl',
'allow_self_signed', true);
$fp = stream_socket_client("tls://$ip:$port", $errno,$errstr, 20,
STREAM_CLIENT_CONNECT, $context);
if(!$fp) echo "CONNECT ERROR: $errstr ($errno)\n";
else // read the packet......
The "stream_socket_client" simply times out.
What am I doing wrong???
Almost the same code works for: (ie changing machines, ports and Certs)
Central-NIC
ZACR/CO.ZA
CoCCA
The FRED test system at TZNIC is running certificate validation - I'm
assuming its got something to do with that????
I'm using a variety of different versioned PHP's
eg
PHP 5.5.18-pl0-gentoo (cli) (built: Nov 10 2014 22:20:27)
PHP 5.5.21-pl0-gentoo (cli) (built: Feb 6 2015 16:46:22)
PHP 5.4.34-pl0-gentoo (cli) (built: Nov 3 2014 11:10:23)
All do the same thing - timeout.
Is anyone using a PHP based client?? - that would be the start of a
WHMCS plugin for C-Panel (etc).
_______________________________________________
fred-users mailing list
fred-users(a)lists.nic.cz
https://lists.nic.cz/cgi-bin/mailman/listinfo/fred-users
12:28 p.m.
Discovered the problem.
I talk to the EPP system at CO.ZA - we both have IPv6. Today - there is
an IPv6 problem at CO.ZA - and I can not connect. I had to change the
'name' to a literal IPv4 address. The function call
"stream_socket_client" can not fall back from IPv6 to IPv4.
this got me thinking again.
When I started talking to the TZNIC folk, I looked up the IP's for their
production server - there is only one IPv4 address. I made an assumption
- no IPv6.
The test server is dual stacked (I never initially checked!). The IPv6
connection failed. A literal IPv4 address works.
My IPv6 trace fails from 2001:4258:400::914:f73f (inside Simbanet -
Tanzania??) - Why oh why don't people put proper reverse DNS on IPv6????
So - has anyone got a wrapper for "stream_socket_client" that when
supplied with a name, looks up both v4 and v6 addresses, tries v6 first
and if it fails, re-tries with v4????
Thanks folk!
On Thu, 2015-03-05 at 12:00 +0100, Jaromir Talir wrote:
There should be many php clients. Mario, your
registrar implementation
is in php, isn't it? What is your php epp connect procedure?
Jaromir
On Wed, 2015-03-04 at 12:04 +0200, Mark Elkins wrote:
--
Mark James ELKINS - Posix Systems - (South) Africa
mje(a)posix.co.za Tel: +27.128070590 Cell: +27.826010496
For fast, reliable, low cost Internet in ZA: https://ftth.posix.co.za
I'd like to have my own client written in PHP
talk to FRED.
I was given separate CRT and KEY files by TZNIC. I've combined this
into a single PEM file with:
cat posix.key posix.crt > /tmp/tznic.pem
I can then successfully get the "Welcome" XML from FRED at TZNIC with:
openssl s_client -connect fred.tznic.or.tz:700 -cert /tmp/tznic.pem
This shows as a self-signed certificate (as expected).
(verify error:num=18:self signed certificate)
The combining of the crt and key is because php seems to want a combined
PEM certificate...
Then - I try connecting with a VERY stripped down PHP script....
(attached)...
The core of which is:
$ip="fred.tznic.or.tz";
$port=700;
$cert="/tmp/tznic.pem";
$context = stream_context_create();
$result = stream_context_set_option($context, 'ssl', 'local_cert',
$cert);
$result = stream_context_set_option($context, 'ssl', 'verify_peer',
false);
$result = stream_context_set_option($context, 'ssl', 'verify_host',
false);
$result = stream_context_set_option($context, 'ssl',
'allow_self_signed', true);
$fp = stream_socket_client("tls://$ip:$port", $errno,$errstr, 20,
STREAM_CLIENT_CONNECT, $context);
if(!$fp) echo "CONNECT ERROR: $errstr ($errno)\n";
else // read the packet......
The "stream_socket_client" simply times out.
What am I doing wrong???
Almost the same code works for: (ie changing machines, ports and Certs)
Central-NIC
ZACR/CO.ZA
CoCCA
The FRED test system at TZNIC is running certificate validation - I'm
assuming its got something to do with that????
I'm using a variety of different versioned PHP's
eg
PHP 5.5.18-pl0-gentoo (cli) (built: Nov 10 2014 22:20:27)
PHP 5.5.21-pl0-gentoo (cli) (built: Feb 6 2015 16:46:22)
PHP 5.4.34-pl0-gentoo (cli) (built: Nov 3 2014 11:10:23)
All do the same thing - timeout.
Is anyone using a PHP based client?? - that would be the start of a
WHMCS plugin for C-Panel (etc).
_______________________________________________
fred-users mailing list
fred-users(a)lists.nic.cz
https://lists.nic.cz/cgi-bin/mailman/listinfo/fred-users
5:18 p.m.
El 05/03/2015 a las 05:00, Jaromir Talir escribió:
There should be many php clients. Mario, your
registrar implementation
is in php, isn't it? What is your php epp connect procedure?
Jaromir
That's correct (Drupal, which uses PHP). But we simply call fred-client
, which is a Python script. We simply pass the corresponding parameters
according to what is requested.
Mario
4173
days inactive
4174
days old
4 comments
4 participants
participants (4)
-
Jan Horak -
Jaromir Talir -
Mario Guerra -
Mark Elkins