【PHP8.x】CURLOPT_SSLCERT_BLOB定数の使い方

Copy
1<?php
2
3/**
4 * Demonstrates how to use CURLOPT_SSLCERT_BLOB and CURLOPT_SSLVERSION
5 * to make an HTTPS request with a client certificate provided as a string blob.
6 *
7 * This function is intended for System Engineers new to PHP and cURL.
8 * It shows how to set a client certificate and its private key directly from
9 * strings (blobs) without needing to store them in files, and how to specify
10 * a particular SSL/TLS version for the connection.
11 *
12 * @return void
13 */
14function makeSecureCurlRequestWithBlobCert(): void
15{
16    // --- IMPORTANT: Dummy Certificate and Private Key for Demonstration ---
17    // In a real application, these would be valid PEM formatted strings
18    // loaded securely from environment variables, a secure vault, or a configuration
19    // system, NOT hardcoded like this.
20    // The content below is a placeholder and NOT a functional certificate/key pair.
21    $dummyCertBlob = <<<EOT
22-----BEGIN CERTIFICATE-----
23MIIDMjCCAlqgAwIBAgIRAPuW07E4dM2f... (your actual client certificate content here)
24-----END CERTIFICATE-----
25EOT;
26
27    $dummyKeyBlob = <<<EOT
28-----BEGIN PRIVATE KEY-----
29MIIEvgIBADANBgkqhkiG9w0BAQEFAASC... (your actual client private key content here)
30-----END PRIVATE KEY-----
31EOT;
32
33    // The URL to make the request to. Use a public HTTPS URL for testing.
34    // Note: Most public websites like example.com do not require client certificates.
35    // For a real client certificate authentication scenario, you would target an
36    // endpoint that is configured to require and validate client certificates.
37    $url = 'https://www.example.com/';
38
39    // Initialize a cURL session
40    $ch = curl_init();
41
42    if ($ch === false) {
43        echo "Error: Failed to initialize cURL session.\n";
44        return;
45    }
46
47    // Set the URL for the request
48    curl_setopt($ch, CURLOPT_URL, $url);
49    // Return the transfer as a string instead of outputting it directly
50    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
51    // Don't include the header in the output
52    curl_setopt($ch, CURLOPT_HEADER, false);
53
54    // --- Set Client Certificate and Private Key from BLOBs (PHP 8.0+) ---
55    // CURLOPT_SSLCERT_BLOB: Specifies the client certificate content as a string.
56    // This is useful when the certificate is available in memory rather than a file.
57    curl_setopt($ch, CURLOPT_SSLCERT_BLOB, $dummyCertBlob);
58
59    // CURLOPT_SSLKEY_BLOB: Specifies the private key content for the client certificate as a string.
60    // This is typically required when CURLOPT_SSLCERT_BLOB is used.
61    curl_setopt($ch, CURLOPT_SSLKEY_BLOB, $dummyKeyBlob);
62
63    // --- Set the SSL/TLS Version (CURLOPT_SSLVERSION) ---
64    // Specifies the desired SSL/TLS protocol version to use.
65    // For modern and secure connections, CURL_SSLVERSION_TLSv1_2 or CURL_SSLVERSION_TLSv1_3
66    // are highly recommended. Avoid older versions like SSLv2 or SSLv3 due to security vulnerabilities.
67    curl_setopt($ch, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
68
69    // --- SSL Verification Settings ---
70    // It's crucial to verify the peer's certificate in production environments.
71    // CURLOPT_SSL_VERIFYPEER: Verify the authenticity of the peer's SSL certificate.
72    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
73    // CURLOPT_SSL_VERIFYHOST: Verify the host name against the certificate's common name or subject alternative names.
74    // Value '2' means to check both existence and matching of a common name.
75    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
76
77    // Execute the cURL request
78    $response = curl_exec($ch);
79
80    // Check for cURL errors
81    if (curl_errno($ch)) {
82        echo 'cURL Error (' . curl_errno($ch) . '): ' . curl_error($ch) . "\n";
83    } else {
84        echo "cURL request completed successfully.\n";
85        echo "SSL Certificate BLOB, Private Key BLOB, and SSL Version options were set.\n";
86        // Output a part of the response to show it worked (if any)
87        echo "Response (first 150 characters): " . substr((string)$response, 0, 150) . "...\n";
88    }
89
90    // Close the cURL session
91    curl_close($ch);
92}
93
94// Call the function to demonstrate the usage
95makeSecureCurlRequestWithBlobCert();

このPHPのサンプルコードは、cURL拡張機能を用いてHTTPSリクエストを行う際に、クライアント証明書と秘密鍵をファイルではなく、直接文字列データ（BLOB）として設定する方法、および使用するSSL/TLSプロトコルバージョンを指定する方法を、システムエンジニアを目指す初心者に示します。

CURLOPT_SSLCERT_BLOBは、PHP 8.0以降で利用可能な定数で、クライアント証明書のコンテンツをPEM形式の文字列として直接指定するために使用します。これにより、証明書ファイルをディスクに保存する必要がなくなり、メモリ上のデータを利用できます。秘密鍵も同様にCURLOPT_SSLKEY_BLOBを使って文字列として設定します。これらの定数自体は引数を取らず、それ自体に戻り値もありませんが、curl_setopt関数に渡す設定値として機能します。

CURLOPT_SSLVERSIONは、HTTPS接続に使用するSSL/TLSプロトコルのバージョンを指定する定数です。セキュリティのため、CURL_SSLVERSION_TLSv1_2やCURL_SSLVERSION_TLSv1_3のような最新かつ安全なバージョンを使用することが強く推奨されます。

実運用では、サンプルコード内のダミーデータではなく、環境変数などから安全にロードした実際の証明書と秘密鍵を使用し、CURLOPT_SSL_VERIFYPEERなどを有効にしてサーバー証明書の検証を厳格に行うことが非常に重要です。