来自Symfony2控制器的SSL错误

如何从本地主机上的Symfony2控制器调用https（SSL）url？我正在使用Debril RssAtomBundle包来调用Google Blogger API，它只在https上，我不知道如何从localhost实现这一点。当URL返回浏览器中预期的博客内容时，我的Google Blogger API调用肯定会起作用。我想确保代码也是安全的

调用URL时出现的错误是：

SSL证书问题，请验证CA证书是否正常

听起来你需要用它作为信任的锚。就

*.blogger.com

而言，谷歌的CA似乎也是由

GeoTrust全球CA

签署的：

$ openssl s_client -connect blogger.com:443
CONNECTED(00000003)
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=*.blogger.com
   i:/C=US/O=Google Inc/CN=Google Internet Authority G2
 1 s:/C=US/O=Google Inc/CN=Google Internet Authority G2
   i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
   i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
 ...

Start Time: 1407035752
Timeout   : 300 (sec)
Verify return code: 20 (unable to get local issuer certificate)

---

一旦您将Google CA用作信任锚，它将验证OK（注意添加了

-CAfile

选项）：

---

提示：下载

GIAG2.crt

后，您需要使用

opensslx509-in-GIAG2.crt-inform-DER-out-GIAG2.PEM-outform-PEM将其从ASN.1/DER转换为PEM

这对我来说并不清楚：“…不确定如何从本地主机…[调用Google Blogger API]”。从

localhost

调用是什么意思？我的控制器有一个调用Google Blogger API的方法。我正在本地主机（）上以app_dev.php模式使用我的web应用程序。Google API使用https，因此出现SSL认证错误，因为我的应用程序无法从本地主机域调用https。如果需要，为什么Google不共享PEM文件？一旦我有了那个文件，我该怎么处理它？它只是我应用程序的根目录吗？我需要配置我的Symfony应用程序吗？

$ openssl s_client -connect blogger.com:443
CONNECTED(00000003)
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=*.blogger.com
   i:/C=US/O=Google Inc/CN=Google Internet Authority G2
 1 s:/C=US/O=Google Inc/CN=Google Internet Authority G2
   i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
   i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
 ...

Start Time: 1407035752
Timeout   : 300 (sec)
Verify return code: 20 (unable to get local issuer certificate)

$ openssl s_client -connect blogger.com:443 -CAfile GIAG2.pem 
CONNECTED(00000003)
depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority
verify return:1
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify return:1
depth=1 C = US, O = Google Inc, CN = Google Internet Authority G2
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google Inc, CN = *.blogger.com
verify return:1
...

Start Time: 1407035642
Timeout   : 300 (sec)
Verify return code: 0 (ok)