Question

我正在使用PHP实现SOAP客户端。我从实现SOAP服务的远程公司收到了.pfx证书。

当我在Chrome中导入此.pfx并在https://api.test.remote.company.com/O/OMS.svc?singlewsdl打开WDSL文件时，我确实获得了一个XML文件。

由于我需要为PHP .pem使用SoapClient证书，因此我已将.pfx转换为以下内容：

openssl pkcs12 -in received.pfx -out converted.pem -clcerts

由于我的客户仍然遇到问题，我使用Curl进行测试：

curl --verbose --cert converted.pem:MyPassphrase https://api.test.remote.company.com/O/OMS.svc?singlewsdl

但我收到403错误消息：

*   Trying 123.4.56.789...
* Connected to api.test.remote.company.com (123.4.56.789) port 443 (#0)
* found 173 certificates in /etc/ssl/certs/ca-certificates.crt
* found 697 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ECDHE_RSA_AES_256_CBC_SHA384
*    server certificate verification OK
*    server certificate status verification SKIPPED
*    common name: test.api.company.com (matched)
*    server certificate expiration date OK
*    server certificate activation date OK
*    certificate public key: RSA
*    certificate version: #3
*    subject: C=RU,ST=Moscow,L=Moscow,O=AO Company Lab,OU=IT,CN=test.api.company.com
*    start date: Tue, 31 May 2016 00:00:00 GMT
*    expire date: Thu, 08 Jun 2017 23:59:59 GMT
*    issuer: C=US,O=thawte\, Inc.,CN=thawte SSL CA - G2
*    compression: NULL
* ALPN, server did not agree to a protocol
> GET /O/OMS.svc?singlewsdl HTTP/1.1
> Host: api.test.remote.company.com
> User-Agent: curl/7.50.1
> Accept: */*
> 
< HTTP/1.1 403 Forbidden ( The page requires a client certificate as part of the authentication process. If you are using a smart card, you will need to insert your smart card to select an appropriate certificate. Otherwise, contact your server administrator.  )
< Connection: close
< Pragma: no-cache
< Cache-Control: no-cache
< Content-Type: text/html
...

有谁知道发生了什么以及如何解决？

Answer 1

将.pfx证书转换为.pem的以下过程解决了问题：

openssl pkcs12 -in the.pfx -out cert.pem -clcerts -nokeys

openssl pkcs12 -in the.pfx -out key.pem -nocerts

然后将cert.pem和key.pem文件合并到一个唯一的文件中，无需任何添加。

403 Forbidden - 该页面需要客户端证书作为身份验证过程的一部分

1 个答案: