PHP cURL突发SSL协议错误：TLSv1.1/TLSv1.2无法正常工作

Hey there, let's tackle this cURL SSL error and TLS version issue step by step — I've seen this crop up a lot when servers drop older TLS versions or local environments are out of date. Let's break down the problems in your code and the fixes:

First, Fix the Duplicate curl_exec Bug #

Your current code calls curl_exec($ch) twice: once to assign $xml, then again in the error check. This causes the request to run twice, and the second call will often fail because the connection is already closed. That's probably contributing to some of your unexpected errors.

1. Explicitly Specify TLS Version #

The "Unknown SSL protocol error" usually happens because cURL is trying to use an older TLS version (like TLSv1.0) that the remote server no longer supports. Force it to use TLSv1.1 or TLSv1.2 (preferably 1.2, since it's more secure) by adding the CURLOPT_SSLVERSION option.

• For PHP 5.5.19+ or newer, use the predefined constants:

  curl_setopt($ch, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
  

• If you're on an older PHP version that doesn't have these constants, use the numeric value instead (6 = TLSv1.2, 5 = TLSv1.1):

  curl_setopt($ch, CURLOPT_SSLVERSION, 6);
  

2. Verify Your cURL/OpenSSL Environment #

If setting the TLS version doesn't work, your server's cURL or OpenSSL library might not support TLSv1.1/1.2. Here's how to check:

• Create a PHP file with <?php phpinfo(); ?> and look for:
  • cURL Information → check the version (needs 7.34.0+ for full TLSv1.2 support)
  • OpenSSL Version → needs 1.0.1c or newer to support TLSv1.1/1.2
• Or run this command in your terminal:

  curl -V
  

  This will show you the cURL version and supported SSL protocols. If TLSv1.1/1.2 aren't listed, you'll need to update your cURL or OpenSSL packages.

3. Tweak SSL Verification (If Needed) #

Sometimes the error comes from invalid SSL certificates on the remote server, or your server doesn't trust the CA certificate. Only do this for testing (never in production):

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);

For production, fix the CA certificate issue by pointing cURL to a valid CA bundle:

curl_setopt($ch, CURLOPT_CAINFO, '/path/to/cacert.pem');

4. Fix Connection Timeout #

Setting CURLOPT_CONNECTTIMEOUT to 0 means infinite timeout, which is bad practice. Set it to a reasonable value (like 30 seconds):

curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 30);

Corrected Full Code #

Here's your code with all the fixes applied:

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $xml_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 30);
// Force TLSv1.2
curl_setopt($ch, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
// Optional: Uncomment below only for testing (not production)
// curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
// curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);

$xml = curl_exec($ch);

if ($xml === false) {
    echo curl_error($ch);
} else {
    echo 'Operation completed without any errors';
}

curl_close($ch);
return $xml;

内容的提问来源于stack exchange，提问作者Gkra