Issue connecting to HTTPS site through CURL

Question

All,
I am having trouble requesting info from HTTPS site using CURL and PHP. I am using Solaris 10. It so happens that sometimes it works and sometimes it doesn't. I am not sure what is the cause. If it doesn't work, this is the entry recorded in the verbose log:
* About to connect() to 10.10.101.12 port 443 (#0)
*   Trying 10.10.101.12... * connected
* Connected to 10.10.101.12 (10.10.101.12) port 443 (#0)
* error setting certificate verify locations, continuing anyway:
*   CAfile: /etc/opt/webstack/curl/curlCA
  CApath: none
* error:80089077:lib(128):func(137):reason(119)
* Closing connection #0If it works, this is the entry recorded in the verbose log:
* About to connect() to 10.10.101.12 port 443 (#0)
*   Trying 10.10.101.12... * connected
* Connected to 10.10.101.12 (10.10.101.12) port 443 (#0)
* error setting certificate verify locations, continuing anyway:
*   CAfile: /etc/opt/webstack/curl/curlCA
  CApath: none
* SSL connection using DHE-RSA-AES256-SHA
* Server certificate:
*        subject: C=CA, ST=British Columnbia, L=Vancouver, O=google, OU=FDN, CN=g.googlenet.com, [email protected]
*        start date: 2007-07-24 23:06:32 GMT
*        expire date: 2027-09-07 23:06:32 GMT
*        issuer: C=US, ST=California, L=Sunnyvale, O=Google, OU=Certificate Authority, CN=support, [email protected]
*        SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
POST /gportal/gpmgr HTTP/1.1^MHost: 10.10.101.12^M
Accept: */*^M
Accept-Encoding: gzip,deflate^M
Content-Length: 1623^M
Content-Type: application/x-www-form-urlencoded^M
Expect: 100-continue^M
^M
< HTTP/1.1 100 Continue^M
< HTTP/1.1 200 OK^M
< Date: Wed, 28 Apr 2010 21:56:15 GMT^M
< Server: Apache^M
< Cache-Control: no-cache^M
< Pragma: no-cache^M
< Vary: Accept-Encoding^M
< Content-Encoding: gzip^M
< Content-Length: 1453^M
< Content-Type: application/json^M
< ^M
* Connection #0 to host 10.10.101.12 left intact
* Closing connection #0My CURL options are as under:
    $ch = curl_init();
    $devnull = fopen('/tmp/curlcookie.txt', 'w');
    $fp_err = fopen('/tmp/verbose_file.txt', 'ab+');
    fwrite($fp_err, date('Y-m-d H:i:s')."\n\n");
    curl_setopt($ch, CURLOPT_STDERR, $devnull);
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_URL, $desturl);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
    curl_setopt($ch, CURLOPT_HEADER, false);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT,120);
    curl_setopt($ch, CURLOPT_AUTOREFERER, true);
    curl_setopt($ch, CURLOPT_ENCODING, 'gzip,deflate');
    curl_setopt($ch, CURLOPT_POSTFIELDS, $postdata);
    curl_setopt($ch, CURLOPT_VERBOSE,1);
    curl_setopt($ch, CURLOPT_FAILONERROR, true);
    curl_setopt($ch, CURLOPT_STDERR, $fp_err);
    $ret = curl_exec($ch);Anybody has any idea, why it works sometimes but fails mostly? The error I am trying to solve is error:80089077:lib(128):func(137):reason(119)
Thanks

Answer 1

There seems to be some confusion here. Maybe I misunderstood your original question...
Glassfish is an Java application server.
Since you were reporting issues with PHP, I assumed you were referring to an apache httpd server.
Coolstack is a repository which contains a version of both tomcat and apache.
So I suppose that glassfish could be considered to be a replacement for the tomcat in coolstack.
However since their so different. I would have said competitor rather than replacement.
But arent we talking about apache?
But the root of the problem is actually an openssl bug.
So the issue would be to install a different copy of openssl. Then use applications that are linked against it.
Whether curl or apache or tomcat. Whatever you are seeing the problem in.
So I was more suggesting that you could try a different version of curl/openssl. It doesnt matter if you get it from coolstack or sunfreeware, or blastwave or opencsw. Or compile it yourself.
But I suggest you try patching first and hopefully you can fix the version your already using rather than replacing large amounts of software with a completely new version.