Question

I’m going to POST some data from site A to site B using PHP. Site A has a commercial SSL certificate. Site B is going to have a self-signed certificate. Is this doable? If not, are there any configuration options in PHP (or Apache) that I can set to bypass the restrictions?

Answer 1

Presumably you’ll be using curl on server A? There’s a couple options in curl to disable certificate validation, which’ll allow self-signed certs through. The link will still be encrypted, but you won’t be able to trust that server B really IS server B:

curlopt_ssl_verifypeer  (checking the CA auth chain)
curlopt_ssl_verifyhost  (hostname/certname match checks)

Example PHP code:

$ch = curl_init("https://example.com/example/path"); 
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$response = curl_exec($ch);