Option `CURLOPT_SSLCERT_BLOB` not guaranteed available on cURL `7.80.0` and PHP `8.3`?

[remcotolsma]

Client got the following error:

2024/06/07 10:29:56 [error] 864577#864577: *919 FastCGI sent in stderr: "PHP message: PHP Fatal error: Uncaught ValueError: curl_setopt(): Argument #2 ($option) is not a valid cURL option in packages/pronamic/pronamic-pay-ideal-2/src/Integration.php:88

Stack trace:

#0 packages/pronamic/pronamic-pay-ideal-2/src/Integration.php(88): curl_setopt()

Internal HelpScout ticket: https://secure.helpscout.net/conversation/2509458673/26893?viewId=1425710#thread-7880500989

---

The cURL option CURLOPT_SSLCERT_BLOB should be available since cURL 7.71.0?

• https://curl.se/libcurl/c/CURLOPT_SSLCERT_BLOB.html
• https://curl.se/libcurl/c/tls-options.html
• curl: Add version 7.71.0 blob options php/php-src#7194

I asked ChatGTP following question:

Why is the CURLOPT_SSLCERT_BLOB option not available in PHP 8.3 with cURL version 7.80.0 mbedTLS/2.28.8?

---

The absence of the CURLOPT_SSLCERT_BLOB option in PHP 8.3 with cURL version 7.80.0 mbedTLS/2.28.8 could be due to several reasons:

1. Version Compatibility: It's possible that the CURLOPT_SSLCERT_BLOB option was removed or not implemented in this specific version of PHP or cURL. Updates and changes to PHP extensions and libraries can sometimes result in the removal or modification of certain features.

2. Library Support: The mbedTLS library might not support this specific option or it could be implemented differently from other SSL libraries. It's important to check the documentation for both PHP and cURL to see if there are any mentions of this option being deprecated or not supported.

3. Bug or Oversight: There's always the possibility of a bug or oversight in the implementation. It's worth checking the bug trackers or forums for PHP and cURL to see if others have encountered similar issues or if there's any ongoing discussion about this.

4. Alternative Approach: If CURLOPT_SSLCERT_BLOB is not available, you might need to explore alternative approaches for achieving the same functionality, such as using CURLOPT_SSLCERT with a file path instead of a blob, or using a different SSL library that supports passing certificate data as a blob.

To get a more precise answer, you might want to consult the official documentation, release notes, or community forums for PHP, cURL, and mbedTLS to see if there are any specific explanations or announcements regarding the absence of this option.

[remcotolsma]

I just found the following page: https://curl.se/libcurl/c/tls-options.html.

TLS related options and the backends they work with

libcurl can use different TLS backends, selected at both build-time and run-time. This table shows all TLS related options and details the set of TLS backends that work with it.

The OpenSSL column also covers BoringSSL, libressl, quictls, AWS-LC and AmiSSL.

option	BearSSL	GnuTLS	mbedTLS	OpenSSL	rustls	Schannel	Secure Transport	wolfSSL
CURLINFO_CAINFO	✔	✔	✔	✔	✔	✔	✔	✔
CURLINFO_CAPATH		✔	✔	✔				✔
CURLINFO_CERTINFO		✔		✔		✔	✔
CURLINFO_PROXY_SSL_VERIFYRESULT		✔		✔
CURLINFO_SSL_ENGINES				✔
CURLINFO_SSL_VERIFYRESULT		✔		✔
CURLINFO_TLS_SESSION		✔		✔
CURLINFO_TLS_SSL_PTR	✔	✔	✔	✔		✔	✔	✔
CURLOPT_CAINFO	✔	✔	✔	✔	✔	✔	✔	✔
CURLOPT_CAINFO_BLOB	✔		✔	✔	✔	✔	✔	✔
CURLOPT_CAPATH		✔	✔	✔				✔
CURLOPT_CA_CACHE_TIMEOUT		✔		✔		✔		✔
CURLOPT_CERTINFO		✔		✔		✔	✔
CURLOPT_CRLFILE		✔	✔	✔
CURLOPT_DOH_SSL_VERIFYHOST	✔	✔	✔	✔	✔	✔	✔	✔
CURLOPT_DOH_SSL_VERIFYPEER	✔	✔	✔	✔	✔	✔	✔	✔
CURLOPT_DOH_SSL_VERIFYSTATUS		✔		✔
CURLOPT_ECH				✔				✔
CURLOPT_EGDSOCKET				✔
CURLOPT_ISSUERCERT		✔		✔
CURLOPT_ISSUERCERT_BLOB				✔
CURLOPT_KEYPASSWD			✔	✔		✔		✔
CURLOPT_PINNEDPUBLICKEY		✔	✔	✔		✔	✔	✔
CURLOPT_PROXY_CAINFO	✔	✔	✔	✔	✔	✔	✔	✔
CURLOPT_PROXY_CAINFO_BLOB				✔	✔	✔	✔
CURLOPT_PROXY_CAPATH		✔	✔	✔
CURLOPT_PROXY_CRLFILE		✔	✔	✔
CURLOPT_PROXY_ISSUERCERT		✔		✔
CURLOPT_PROXY_ISSUERCERT_BLOB				✔
CURLOPT_PROXY_KEYPASSWD			✔	✔		✔		✔
CURLOPT_PROXY_PINNEDPUBLICKEY		✔	✔	✔				✔
CURLOPT_PROXY_SSLCERT		✔	✔	✔		✔	✔	✔
CURLOPT_PROXY_SSLCERTTYPE		✔	✔	✔		✔	✔	✔
CURLOPT_PROXY_SSLCERT_BLOB				✔		✔	✔
CURLOPT_PROXY_SSLKEY			✔	✔		✔		✔
CURLOPT_PROXY_SSLKEYTYPE	✔			✔				✔
CURLOPT_PROXY_SSLKEY_BLOB				✔
CURLOPT_PROXY_SSLVERSION	✔	✔	✔	✔	✔	✔	✔	✔
CURLOPT_PROXY_SSL_CIPHER_LIST	✔	✔	✔	✔		✔	✔	✔
CURLOPT_PROXY_SSL_OPTIONS	✔	✔	✔	✔	✔	✔	✔	✔
CURLOPT_PROXY_SSL_VERIFYHOST	✔	✔	✔	✔	✔	✔	✔	✔
CURLOPT_PROXY_SSL_VERIFYPEER	✔	✔	✔	✔	✔	✔	✔	✔
CURLOPT_PROXY_TLS13_CIPHERS				✔		✔
CURLOPT_PROXY_TLSAUTH_PASSWORD		✔		✔
CURLOPT_PROXY_TLSAUTH_TYPE		✔		✔
CURLOPT_PROXY_TLSAUTH_USERNAME		✔		✔
CURLOPT_RANDOM_FILE				✔
CURLOPT_SSLCERT		✔	✔	✔		✔	✔	✔
CURLOPT_SSLCERTTYPE		✔	✔	✔		✔	✔	✔
CURLOPT_SSLCERT_BLOB			✔	✔		✔	✔
CURLOPT_SSLENGINE				✔
CURLOPT_SSLENGINE_DEFAULT				✔
CURLOPT_SSLKEY			✔	✔		✔		✔
CURLOPT_SSLKEYTYPE	✔			✔				✔
CURLOPT_SSLKEY_BLOB				✔
CURLOPT_SSLVERSION	✔	✔	✔	✔	✔	✔	✔	✔
CURLOPT_SSL_CIPHER_LIST	✔	✔	✔	✔		✔	✔	✔
CURLOPT_SSL_CTX_DATA	✔		✔	✔				✔
CURLOPT_SSL_CTX_FUNCTION	✔		✔	✔				✔
CURLOPT_SSL_EC_CURVES				✔				✔
CURLOPT_SSL_ENABLE_ALPN	✔	✔	✔	✔	✔	✔	✔	✔
CURLOPT_SSL_ENABLE_NPN	✔	✔	✔	✔	✔	✔	✔	✔
CURLOPT_SSL_FALSESTART							✔
CURLOPT_SSL_OPTIONS	✔	✔	✔	✔	✔	✔	✔	✔
CURLOPT_SSL_SESSIONID_CACHE	✔	✔	✔	✔	✔	✔	✔	✔
CURLOPT_SSL_VERIFYHOST	✔	✔	✔	✔	✔	✔	✔	✔
CURLOPT_SSL_VERIFYPEER	✔	✔	✔	✔	✔	✔	✔	✔
CURLOPT_SSL_VERIFYSTATUS		✔		✔
CURLOPT_TLS13_CIPHERS				✔		✔
CURLOPT_TLSAUTH_PASSWORD		✔		✔
CURLOPT_TLSAUTH_TYPE		✔		✔
CURLOPT_TLSAUTH_USERNAME		✔		✔

The CURLOPT_SSLCERT_BLOB option should be available on mbedTLS, but maybe support for it was add in a later version then cURL version 7.80.0 mbedTLS/2.28.8?

Another problem is that CURLOPT_SSLKEY_BLOB only works with OpenSSL according to the table above.
😬

---

We could bypass the CURLOPT_SSLCERT_BLOB option by using a temporary file?

if ( ! \defined( 'CURLOPT_SSLCERT_BLOB' ) ) {
	$file = \tempnam( \sys_get_temp_dir(), 'pronamic_curl_sslcert_blob' );

	\file_put_contents( $file, $parsed_args['ssl_certificate_blob'] );

	// phpcs:ignore WordPress.WP.AlternativeFunctions.curl_curl_setopt -- WordPress requests library does not support this yet.
	\curl_setopt( $handle, \CURLOPT_SSLCERT, $file );
}

[remcotolsma]

This matrix table provided in my previous comment seems to be pretty new:

• https://github.com/curl/curl/blob/385c62aabc388e62162c634e97ee61d1ab8bf81c/docs/libcurl/opts/CURLOPT_SSLCERT_BLOB.md?plain=1#L13-L17
• docs/libcurl: add TLS backend info for all TLS options curl/curl#13168

[remcotolsma]

The cURL option CURLOPT_SSLCERT_BLOB should be available since cURL 7.71.0?

After finding the matrix table above, we found that CURLOPT_SSLCERT_BLOB has only been available for mbedTLS since version 7.78, support for this was added on Jun 1, 2021 in curl/curl@05e0453.

[remcotolsma]

I just tried the following code on PHP 7.4.3-4ubuntu2.20, cURL 7.68.0 and SSL OpenSSL/1.1.1f, but that does not result in a fatal error in PHP 7.4.3:

<?php

$curl_handle = curl_init();

curl_setopt($curl_handle, CURLOPT_FAILONERROR, true ); 
curl_setopt( $curl_handle, CURLOPT_SSLCERT_BLOB, 'test' );
curl_setopt( $curl_handle, CURLOPT_SSLKEY_BLOB, 'test abcd' );

var_dump( curl_version() );

Also found the following page:
https://curl.se/libcurl/c/CURLOPT_SSLCERT_BLOB.html

Availability
Added in 7.71.0. This option is supported by the OpenSSL, Secure Transport, Schannel and mbedTLS (since 7.78.0) backends.

[remcotolsma]

I asked ChatGPT why they would use embedTLS instead of OpenSSL, and some good arguments were given. That's why I built in a fallback: https://github.com/pronamic/wp-http-extended-ssl-support/blob/a5e44e9cc216f9527796fe3473e06802ce2df85a/src/Plugin.php.