How to enable CURLOPT_SSL_VERIFYHOST = 2 support on my OS/PHP

Question

I have been developing a site locally that authenticates against a centrailzed signon. One of the steps is requiring me to make a curl request to an https resource to get an access token.

Part of the curl config is:

    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);                                         
    //curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);

As you can see I commented out the CURLOPT_SSL_VERIFYHOST option. I have read on php.net and on various blogs/stackoverflow (Security consequences of disabling CURLOPT_SSL_VERIFYHOST (libcurl/openssl)) posts WHAT these options mean.

On my development machine CURLOPT_SSL_VERIFYHOST 2 has been working fine. I am just using the vanilla php install provided in ubuntu 12.04 php5 package, and php5-curl.

On production (rackspace cloudsites) the CURLOPT_SSL_VERIFYHOST 2 is not working, which is why I changed it to false to verify this was the issue. Seeing as i didn't explicitly do anything to enable this on my localhost I do not know what directives/config options controls this.

What I mean by it is "not working" is that on production the curl call is returning an http_code of 0 when the VERIFYHOST is set to 2. When I set it to FALSE it is returning a status code of 200

My question is:

How can i enable SSL_VERIFYHOST on a linux box?

Any help would be greatly appreciated. Thank you.

Answer 1

For '2' you have to ensure the common name in the SSL certificate matches the hostname being utilized. This is the default and should be straight-forward as long as your SSL certificate is appropriately created for the hostname (common name) you're using it on.

From the PHP curl_setopt manual:

1 to check the existence of a common name in the SSL peer certificate. 2 to check the existence of a common name and also verify that it matches the hostname provided. In production environments the value of this option should be kept at 2 (default value).

Manual Entry for curl_setopt