Bug #75086 [Opn->Fbk]: steam_socket_enable_crypto ignores verify_peer, verify_peer_name and allow_self

Edit report at https://bugs.php.net/bug.php?id=75086&edit=1 ID: 75086 Updated by: daverandom@php.net Reported by: root dot talis at gmail dot com Summary: steam_socket_enable_crypto ignores verify_peer, verify_peer_name and allow_self -Status: Open +Status: Feedback Type: Bug Package: OpenSSL related Operating System: Elementary OS 0.4.1 Loki PHP Version: 7.1.8 Block user comment: N Private report: N New Comment: Not enough information was provided for us to be able to handle this bug. Please re-read the instructions at http://bugs.php.net/how-to-report.php If you can provide more information, feel free to add it to this bug and change the status back to "Open". Thank you for your interest in PHP. Please note that the error in question is generated by the local_cert option and not by verify_peer, verify_peer_name or allow_self_signed, see https://lxr.room11.org/xref/php-src%407.1/ext/openssl/xp_ssl.c#905 - if this step fails during initialisation of the SSL context, it will fail early before attempting to initiate the SSL layer. Please verify that your certificate file is in a format that is accepted by SSL_CTX_use_certificate_chain_file() per https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_use_certificate_chain_file.html, it must be PEM encoded. Previous Comments: ------------------------------------------------------------------------ [2017-08-17 12:47:58] kelunik@php.net Uhm, why do you set stream_context_set_option($context, 'ssl', 'ciphers', 'SSLv3')? It's pretty likely that the other side will not accept any of these, see https://www.openssl.org/docs/man1.0.2/apps/ciphers.html for a list of ciphers that 'SSLv3' includes. What happens if you remove that line? Might be that it's just showing the wrong error message. ------------------------------------------------------------------------ [2017-08-17 12:37:02] root dot talis at gmail dot com Description: ------------ I try to call stream_socket_enable_crypto() on an open connection with a self-signed certificate. verify_peer is disabled, verify_peer_name is disabled, allow_self_signed is enabled, but PHP throws the following warning: "stream_socket_enable_crypto(): Unable to set local cert chain file `/tmp/admin.crt'; Check that your cafile/capath settings include details of your certificate and its issuer" PHP is installed from this repository: https://launchpad.net/~ondrej/+archive/ubuntu/php Unfortunately, I haven't found any information about the compile configure line. I believe that the PPA maintainer can provide this information. My setup: PHP version: PHP 7.1.8-2+ubuntu16.04.1+deb.sury.org+4 (cli) (built: Aug 4 2017 13:04:12) ( NTS ) OS: Elementary OS 0.4.1 Loki (based on Ubuntu Xenial) OpenSSL version: OpenSSL 1.1.0f 25 May 2017 This is what my certificate metadata looks like (actual values replaced): ``` Bag Attributes localKeyID: 00 11 22 33 44 55 66 77 88 99 AA BB CC DD EE FF 00 11 22 33 subject=/C=RU/ST=Moscow/O=Removed/OU=Removed/CN=Removed/emailAddress=removed@example.com issuer=/C=RU/ST=Moscow/L=Moscow/O=Removed/OU=Removed/CN=www.example.org/emailAddress=removed@example.com -----BEGIN CERTIFICATE----- [certificate goes here] ``` I have reported this bug to the PPA bug tracker, and it's maintainer requested me to report this bug here. Original report URL: https://github.com/oerdnj/deb.sury.org/issues/661 Test script: --------------- <?php $address = gethostbyname('localhost'); $port = 443; // put any open port on any host here $context = stream_context_create(); stream_context_set_option($context, 'ssl', 'capture_peer_cert', true); stream_context_set_option($context, 'ssl', 'local_cert', __DIR__.'/admin.crt'); stream_context_set_option($context, 'ssl', 'passphrase', 'yourCertPassword'); stream_context_set_option($context, 'ssl', 'ciphers', 'SSLv3'); stream_context_set_option($context, 'ssl', 'verify_peer', false); stream_context_set_option($context, 'ssl', 'verify_peer_name', false); stream_context_set_option($context, 'ssl', 'allow_self_signed', true); $errno = null; $errstr = null; $socket = stream_socket_client("tcp://$address:$port", $errno, $errstr, 30, STREAM_CLIENT_CONNECT, $context); stream_socket_enable_crypto($socket, true, STREAM_CRYPTO_METHOD_TLS_CLIENT); Expected result: ---------------- Given that the certificate is correct, I expect no warnings to be thrown. Actual result: -------------- /usr/bin/php7.1 /tmp/test.php PHP Warning: stream_socket_enable_crypto(): Unable to set local cert chain file `/tmp/admin.crt'; Check that your cafile/capath settings include details of your certificate and its issuer in /tmp/test.php on line 17 PHP Stack trace: PHP 1. {main}() /tmp/test.php:0 PHP 2. stream_socket_enable_crypto() /tmp/test.php:17 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=75086&edit=1