In PHP/curl I coded a simple login to a WordPress-based website to login to WP from a mobile client (an iOS app). The website supports https, it is hosted in a shared hosting environment and the certificate they offer by default is a common Let's encrypt certificate.

Problem is anything works just fine but, being not a security expert, I don't understand the implications of some basic security settings: eg. by coding

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

am I potentially causing some security issue? And, if so, what could I do?

Any help is appreciated


Yes, there are security implications. You've completely turned off certificate validation, you'll accept invalid certs. You've opened yourself to MitM attacks, and you might as well transmit over http, because you dropped all the security goodies of https.

You should look into why your server doesn't accept let's encrypt certificates (I'm assuming that's why you turned off the verification) and what you can do about it. Alternatively you can look into getting a cert from another CA.

| improve this answer | |
  • No, I didn' turned off it: simply, the test enivronment was http, while the production one is https (a thing I didn't know before yesterday). So I started reviewing my code and, of course, asking myself some questions – 3000 Jul 17 '17 at 14:08
  • @3000, Yes you did. curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); means: ignore any false certificate. See @Mearlyn answer for the details. – Jacco Sep 16 '17 at 10:03

Your question is already answered in the cURL documentation:

WARNING: disabling verification of the certificate allows bad guys to man-in-the-middle the communication without you knowing it. Disabling verification makes the communication insecure. Just having encryption on a transfer is not enough as you cannot be sure that you are communicating with the correct end-point.

Disabling this option (and suppose you are using CURLOPT_PROTOCOLS restrict to CURLPROTO_HTTPS) you can only guaranty that information is transferred over SSL, but you can't ensure if the server that you are connecting is legit.

You can disable this option and still safe if you are using the CURLOPT_PUBLICKEYPINNING, in this case you are restricting the communicating to the one who holds the key that you have specified.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.