├── ca-bundle.tgz
├── curl-test.php
├── LICENSE
└── README.md


/ca-bundle.tgz:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/lunr/mamp-curl-tls/HEAD/ca-bundle.tgz


--------------------------------------------------------------------------------
/curl-test.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | $curl_version = curl_version();
 4 | echo 'SSL Version: ' . $curl_version['ssl_version'] . "\n";
 5 | 
 6 | $ch = curl_init();
 7 | curl_setopt($ch, CURLOPT_URL, "https://tlstest.paypal.com/");
 8 | curl_setopt($ch, CURLOPT_SSLVERSION, 6);
 9 | curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
10 | $response = curl_exec($ch);
11 | if(!$response) { print_r(curl_error($ch)); } else { echo $response; }
12 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | The MIT License (MIT)
 2 | 
 3 | Copyright (c) 2016 James Palm
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
  1 | # Upgrading cURL Library for MAMP 3.4 and 3.5
  2 | 
  3 | PCI DSS compliance is moving to require TLS 1.1 and 1.2 for all SSL / TLS connections between client and server in June 2016. Payment gateways such as PayPal and Authorize.net are requiring TLS 1.2 for applications to use their payment gateways. PayPal is forcing TLS 1.2, Authorize.net will accept TLS 1.1 for June 2016.
  4 | 
  5 | MAMP 3.4 and 3.5 includes the cURL library which is used by PHP for its cURL functions. Unfortunately, the cURL library uses the OpenSSL library that is built into Mac OS X. As of OS X 10.11 El Capitan, the OpenSSL library is still out of date with version 0.9.8, which does not support TLS 1.2.
  6 | 
  7 | **Note: Later versions of macOS 10.15 and greater come with LibreSSL which can be used to compile cURL against if you don't want to use homebrew's openssl formula**
  8 | 
  9 | The steps outlined here will upgrade the MAMP cURL library to OpenSSL v1.1.1 which supports TLS 1.2 and will allow you to support PayPal's new TLS requirements. The upgraded cURL library will be based on the OpenSSL packaged with the homebrew package manager and cURL from the offical website, haxx.se.
 10 | 
 11 | **Disclaimer: I have minimally tested this. But I know that it works in PHP 5.4 based on the test code included at the end of this document. All PHP cURL requests work successfully but I do not know what other subsystems of MAMP may be affected by using this custom compiled version of the cURL library.**
 12 | 
 13 | ## Upgrade Steps
 14 | 
 15 | ### 1) Make sure you have XCode command line tools installed.
 16 | 
 17 | We are going to need a C compiler and other libraries to upgrade cURL. So fire up a Terminal which you will continue to use for each step in this documentation.
 18 | 
 19 |     xcode-select --install
 20 | 
 21 | ### 2) Install Homebrew's OpenSSL library
 22 | 
 23 | The goal is to compile cURL against the OpenSSL library offered by http://brew.sh, so if you do not have homebrew installed yet, follow the instructions on their website or, with caution, run this command:
 24 | 
 25 |     /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
 26 | 
 27 | Next, install the OpenSSL library:
 28 | 
 29 |     brew install openssl@1.1
 30 | 
 31 | ### 3) Check the cURL version included with MAMP
 32 | 
 33 | We just want to confirm which version of cURL we are using because we want to download and install the same version from the official cURL website, haxx.se
 34 | 
 35 |     /Applications/MAMP/Library/bin/curl-config --version
 36 | 
 37 | The command should return with version `7.43.0` or similar. We will be upgrading cURL to a version that supports OpenSSL 1.1.1 which is cURL 7.67 or greater.
 38 | 
 39 | **Make sure to quit MAMP before completing the next steps!**
 40 | 
 41 | ### 4) Download cURL source
 42 | 
 43 | Download cURL's source code from the official site at curl.haxx.se/download or fetch it directly:
 44 | 
 45 |     cd ~/Downloads
 46 |     wget https://curl.haxx.se/download/curl-7.67.0.tar.gz
 47 | 
 48 | Next, extract the tarball and cd into the working directory
 49 | 
 50 |     tar xzvf curl-7.67.0.tar.gz
 51 |     cd curl-7.67.0
 52 | 
 53 | ### 5) Download CA / Certificate bundles and extract into MAMP
 54 | 
 55 | cURL by default does not come with any CA files or bundles. You can find your own source, or download the `ca-bundle.tgz` file from this repository (https://github.com/lunr/mamp-curl-tls) and extract into MAMP:
 56 | 
 57 |     tar xzvf ca-bundle.tgz -C /Applications/MAMP
 58 | 
 59 | ### 6) Compile cURL
 60 | 
 61 | First we need to find the exact path for OpenSSL that was installed via homebrew.
 62 | 
 63 |     ls -l /usr/local/Cellar/openssl*
 64 |     
 65 | This should return something like:
 66 | 
 67 |     /usr/local/Cellar/openssl\@1.1/
 68 |     
 69 | Inside of that directory, we need to find the exact version (eg 1.1.1i):
 70 | 
 71 |     ls -l /usr/local/Cellar/openssl\@1.1/
 72 |     
 73 | This should result in a full path like:
 74 | 
 75 |     /usr/local/Cellar/openssl\@1.1/1.1.1i
 76 |     
 77 | Note this path for the next step. OpenSSL 1.1.1i is the `HEAD` as of 2021-01-01 but may change in the future.
 78 | 
 79 | Execute the following `configure` command in the working directory of the cURL source code:
 80 | 
 81 |     ./configure --prefix=/Applications/MAMP/Library --with-ssl=/usr/local/Cellar/openssl\@1.1/1.1.1i --with-ca-path=/Applications/MAMP/etc/openssl/certs --with-ca-bundle=/Applications/MAMP/etc/openssl/certs/ca-bundle.crt
 82 | 
 83 | This command is written specifically to build against homebrew's OpenSSL library and the CA bundle you downloaded in step 5. You can add your own options if you wish.
 84 | 
 85 | Once the command is complete, you should have output exactly like this:
 86 | 
 87 |     curl version:     7.67.0
 88 |     Host setup:       x86_64-apple-darwin15.4.0
 89 |     Install prefix:   /Applications/MAMP/Library
 90 |     Compiler:         gcc
 91 |     SSL support:      enabled (OpenSSL)
 92 |     SSH support:      no      (--with-libssh2)
 93 |     zlib support:     enabled
 94 |     GSS-API support:  no      (--with-gssapi)
 95 |     TLS-SRP support:  enabled
 96 |     resolver:         default (--enable-ares / --enable-threaded-resolver)
 97 |     IPv6 support:     enabled
 98 |     Unix sockets support: enabled
 99 |     IDN support:      no      (--with-{libidn,winidn})
100 |     Build libcurl:    Shared=yes, Static=yes
101 |     Built-in manual:  enabled
102 |     --libcurl option: enabled (--disable-libcurl-option)
103 |     Verbose errors:   enabled (--disable-verbose)
104 |     SSPI support:     no      (--enable-sspi)
105 |     ca cert bundle:   /Applications/MAMP/etc/openssl/certs/ca-bundle.crt
106 |     ca cert path:     /Applications/MAMP/etc/openssl/certs
107 |     LDAP support:     enabled (OpenLDAP)
108 |     LDAPS support:    enabled
109 |     RTSP support:     enabled
110 |     RTMP support:     no      (--with-librtmp)
111 |     metalink support: no      (--with-libmetalink)
112 |     HTTP2 support:    disabled (--with-nghttp2)
113 |     Protocols:        DICT FILE FTP FTPS GOPHER HTTP HTTPS IMAP IMAPS LDAP LDAPS POP3 POP3S RTSP SMB SMBS SMTP SMTPS TELNET TFTP
114 | 
115 | Specifically, review the lines `Install prefix` and `ca cert path` and `ca cert bundle` and confirm they are pointing to MAMP's directory.
116 | 
117 | If so, continue, else, something was incorrect about the `configure` command
118 | 
119 | ### 7) Install new cURL library
120 | 
121 |     make && make install
122 | 
123 | ### 8) Restart MAMP and confirm OpenSSL version
124 | 
125 | Open the MAMP application and start the servers. You can use `phpinfo()` to confirm the OpenSSL version under the `curl` section of `phpinfo()`. It should read `SSL Version: OpenSSL/1.1.1i`
126 | 
127 | ## How to Test
128 | 
129 | Now that we have upgraded the cURL library, we need to test our connection with PayPal's payment gateway API to make sure MAMP and cURL will support TLS 1.2.
130 | 
131 | Download the `curl-test.php` script from this repository and save it to a web document root in one of your MAMP's virtual hosts.
132 | 
133 | Open the PHP script's URL in a web browser, and you should see output like this:
134 | 
135 |     SSL Version: OpenSSL/1.1.1i
136 |     PayPal_Connection_OK
137 | 
138 | _If the output doesn't match, then your MAMP curl library didn't get updated successfully._
139 | 


--------------------------------------------------------------------------------