title: PHP Curl (with NSS) is probably using SSLv3 instead of TLS when connecting to https
body: <p>I'm using curl library (with NSS) in PHP to connect to my other server. Everything was fine until last week, when the destination server stoped supporting SSLv3 due to poodle vulnerability (CloudFlare by the way). Now, I'm trying to make connection using TLS, but I'm still getting "SSL connect error".</p>
  
  <p>There is sample code, I'm using:</p>
  
  <pre><code>$ch = curl_init();
  curl_setopt_array( $ch, array(
      CURLOPT_URL =&gt; 'https://www.lumiart.cz',
      CURLOPT_RETURNTRANSFER =&gt; true,
      CURLOPT_SSLVERSION =&gt; 1,
      CURLOPT_SSL_VERIFYPEER =&gt; false,
      CURLOPT_VERBOSE =&gt; true
  ) );
  $output = curl_exec( $ch );
  echo $output;
  
  print_r( curl_getinfo( $ch ) );
  
  echo 'error:' . curl_error( $ch );
  
  curl_close($ch);
  </code></pre>
  
  <p>From my understanding, setting <code>CURLOPT_SSLVERSION</code> to <code>1</code> should force connection via TLS.</p>
  
  <p>Note: I have <code>CURLOPT_SSL_VERIFYPEER =&gt; false</code> just for debuging and I'm not meaning to leave it there, once I figure this problem out.</p>
  
  <p>This is output:</p>
  
  <pre><code>Array
  (
      [url] =&gt; https://www.lumiart.cz
      [content_type] =&gt; 
      [http_code] =&gt; 0
      [header_size] =&gt; 0
      [request_size] =&gt; 0
      [filetime] =&gt; -1
      [ssl_verify_result] =&gt; 0
      [redirect_count] =&gt; 0
      [total_time] =&gt; 0
      [namelookup_time] =&gt; 2.3E-5
      [connect_time] =&gt; 0.005777
      [pretransfer_time] =&gt; 0
      [size_upload] =&gt; 0
      [size_download] =&gt; 0
      [speed_download] =&gt; 0
      [speed_upload] =&gt; 0
      [download_content_length] =&gt; -1
      [upload_content_length] =&gt; -1
      [starttransfer_time] =&gt; 0
      [redirect_time] =&gt; 0
      [certinfo] =&gt; Array
          (
          )
  
      [primary_ip] =&gt; 2400:cb00:2048:1::681c:86f
      [redirect_url] =&gt; 
  )
  error:SSL connect error
  </code></pre>
  
  <p>I have all of this at shared hosting provider, so I can't change any php.ini configuration or update any components. All I have is phpinfo(). I've checked for TLS support on these components version and it should be fine. Here is excerpt of phpinfo:</p>
  
  <pre><code>PHP Version 5.4.32
  System  Linux wl42-f262 2.6.32-431.5.1.el6.x86_64 #1 SMP Wed Feb 12 00:41:43 UTC 2014 x86_64
  
  curl:
  cURL support    enabled
  cURL Information    7.19.7
  Age 3
  Features
  AsynchDNS   No
  Debug   No
  GSS-Negotiate   Yes
  IDN Yes
  IPv6    Yes
  Largefile   Yes
  NTLM    Yes
  SPNEGO  No
  SSL Yes
  SSPI    No
  krb4    No
  libz    Yes
  CharConv    No
  Protocols   tftp, ftp, telnet, dict, ldap, ldaps, http, file, https, ftps, scp, sftp
  Host    x86_64-redhat-linux-gnu
  SSL Version NSS/3.15.3
  ZLib Version    1.2.3
  libSSH Version  libssh2/1.4.2
  </code></pre>
  
  <p>I think, that problem is usage of SSLv3 instead of TLS, but I'm not 100% sure. All I'm getting is "SSL connect error" and I don't know, how to find out, which SSL version was used to connect.</p>
  
  <p>Is there a way, how to check, which SSL version is used for connection? Or am I missing something?</p>