# Curl SSL/TLS trust chain verification should not be disabled

**URL:** <https://community.sonarsource.com/t/curl-ssl-tls-trust-chain-verification-should-not-be-disabled/2067>\
**Category:** New rules / language support\
**Tags:** php\
**Created:** [August 27, 2018, 1:41pm UTC](https://community.sonarsource.com/t/curl-ssl-tls-trust-chain-verification-should-not-be-disabled/2067 "2018-08-27T13:41:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pierre-Loup](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/pierre-loup/32/371_2.png) [@Pierre-Loup](https://community.sonarsource.com/u/Pierre-Loup)\
**Post date:** [August 27, 2018, 1:41pm UTC](https://community.sonarsource.com/t/curl-ssl-tls-trust-chain-verification-should-not-be-disabled/2067/1 "2018-08-27T13:41:22Z")

</div>

**Introduction**  
This new feature suggestion comes from a custom rules set dedicated to PHP and Drupal 8 security.

> **[NijiDigital/sonar-php-rules](https://github.com/NijiDigital/sonar-php-rules)**
>
> Custom SonarQube rules for analyzing PHP source code. - NijiDigital/sonar-php-rules

**Description**  
`curl`'s versions of SSL/TLS protocols and cypher suites must be chosen carrefuly and should not be modified at runtime

**Impact**  
Disabeling it exposes the communications to man-in-the-middle attacks.

**Noncompliant Code Example**

```php
curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);

```

**Compliant Code Example**

```php
curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, true);
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, true);

```

**References**

- [MITRE CWE-295](http://cwe.mitre.org/data/definitions/295.html) - Improper Certificate Validation
- [OWASP Top 10 2017 Category A6](https://www.owasp.org/index.php/Top_10-2017_A6-Security_Misconfiguration) - Security Misconfiguration

**Type**  
Vulnerability

**Tags**  
cwe, owasp-a6

---

<div class="post-metadata">

**Author:** ![Alexandre\_Gigleux](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_gigleux/32/26_2.png) [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\
**Post date:** [September 10, 2018, 1:54pm UTC](https://community.sonarsource.com/t/curl-ssl-tls-trust-chain-verification-should-not-be-disabled/2067/2 "2018-09-10T13:54:34Z")

</div>

Hello Pierre-Loup,

I created [RSPEC-4830](https://jira.sonarsource.com/browse/RSPEC-4830) and [RSPEC-4831](https://jira.sonarsource.com/browse/RSPEC-4831) from your rule suggestion.

I believe there is a typo in your **Compliant Code**.  
`curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, true)` should not be considered as safe because “true” is casted to ‘1’ which is not a secure configuration. `CURLOPT_SSL_VERIFYHOST` should be configured to ‘2’.

Thanks

---

<div class="post-metadata">

**Author:** ![Pierre-Loup](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/pierre-loup/32/371_2.png) [@Pierre-Loup](https://community.sonarsource.com/u/Pierre-Loup)\
**Post date:** [October 11, 2018, 7:38am UTC](https://community.sonarsource.com/t/curl-ssl-tls-trust-chain-verification-should-not-be-disabled/2067/3 "2018-10-11T07:38:48Z")

</div>

Rule as been added to sonarPHP.  
[https://github.com/SonarSource/sonar-php/pull/351](https://github.com/SonarSource/sonar-php/pull/351)