I need to do a CURL request from Server A to Server B.
Some sensitive information will be parsed from Server A, which I need to secure.
The problem is, Server A will be MANY different servers:
This will be implemented in a project similar to WordPress, where users download the software and install it on their domain(s) (which ever server holds the users domain, will be Server A). So I’m hoping I don’t need to have SSL on Server A, because that would mean I have to force my users to purchase an SSL certificate.
So, would I need SSL on both sides when sending sensitive information in a CURL request, or could I just get away with having it on Server B, with it still being secure?
Welcome to any alternative suggestions too. 🙂
As far as the connection from Server A to Server B is concerned, Server A isn’t a server, it’s a client. You will need cURL to have been compiled against SSL/TLS libraries to support HTTPS connections, but cURL (or whatever uses libcurl) will behave as a client.
I suspect most installations of cURL nowadays come compiled against OpenSSL or LibNSS. Presumably, you might be referring to cURL via PHP, in which case you should be able to check that in
phpinfo. (Just trying to make a connection to anhttpsURL might also give you an indication: if you get an error along the lines of “this wasn’t compiled with SSL support”, you may have to upgrade your PHP/cURL installation.)What you may need to do on the client side is configure the CA certificates you’re willing to trust (like for any HTTPS connection). cURL as options to set up a CA file/CA path.
In addition, while there is no strict requirement for enabling HTTPS on Server A (the client), you might want to consider it, depending on whether you display any of the sensitive information obtained from Server B on a page served by Server A. Whether this is required really depends on what you do with this information. (Note that, in this case, enabling SSL on Server A would almost be completely separate from configuring the client.)