SSL error "unexpected eof while reading" on same server as the originating request

oucil

3/19/24, 5:30 PM

First, I'm aware of the SSL Library Error: error:0A000126:SSL routines::unexpected eof while reading error stemming from OpenSSL 3 reintroducing a feature to prevent truncation attacks.

The question I have is why I'm seeing this error when I'm making a curl call via PHP from the very same server that's reporting the error?

I'm running Rocky Linux 9.1, PHP 8.0.27, and have OpenSSL 3.0.1 (latest versions available). I can't upgrade to PHP8.1 via the dnf module yet due to missing libraries not yet available for that release.

Since I'm making a curl call from the server to itself, one would think that if it's up to date enough to recognize the error, that it would be issuing the requests properly. The "bug" reports indicate that this is generally from non-compliant servers issuing the requests, so where should I be looking in my system to correct the request format so I can bring myself into compliance and get my curl requests working again?

Here are the current curl opts I'm using with my request...

CURLOPT_HTTPGET => TRUE,
CURLOPT_HEADER => FALSE,
CURLOPT_FAILONERROR => FALSE,
CURLOPT_RETURNTRANSFER => TRUE,
CURLOPT_CONNECTTIMEOUT => 10,
CURLOPT_TIMEOUT => 60,
CURLOPT_SSL_CIPHER_LIST => NULL,
CURLOPT_CAINFO => '/path/to/ca-certs.pem',
CURLOPT_SSL_VERIFYPEER => TRUE,
CURLOPT_SSL_VERIFYHOST => 2

And here are the SSL/TLS related options from httpd.conf...

SSLProtocol -all +TLSv1.3 +TLSv1.2
SSLProxyProtocol -all +TLSv1.3 +TLSv1.2

SSLCipherSuite    TLSv1.3   TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
SSLCipherSuite    SSL       AES256+EECDH:AES256+EDH:!SHA1:!SHA256:!SHA384

SSLHonorCipherOrder on
SSLCompression off
SSLSessionTickets off

SSLOpenSSLConfCmd Curves X25519:secp521r1:prime256v1

Thanks for any help you can offer!

EDIT: Solution below, tldr; had to specify TLS version and cipher in the client request.

8926

1 + 0

php

ssl

openssl

rocky-linux

Score:0

Server

oucil

3/20/24, 12:19 AM

A useful error message would have been helpful, but essentially this boiled down to curl not negotiating one of the limited (but available) ciphers and so failing during the handshake. I had to manually force curl to utilize TLS1.2, and a specific cipher that the server is limited to. Here's what I added to the curlopt list...

CURLOPT_SSLVERSION = CURL_SSLVERSION_TLSv1_2,
CURLOPT_SSL_CIPHER_LIST = 'AES256+EECDH:AES256+EDH'

No more errors. Hope that helps someone avoid the 2 days I wasted on this.

+ 2

Suresh Kumar

5/3/24, 12:53 PM

Where did you added this configuration? In which file?

oucil

5/3/24, 4:11 PM

@SureshKumar Those are PHP "CURLOPT" attributes, so they would go in your PHP request setup.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: SSL error "unexpected eof while reading" on same server as the originating request

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.