Edit report at https://bugs.php.net/bug.php?id=75086&edit=1
ID: 75086
Comment by: kelunik@php.net
Reported by: root dot talis at gmail dot com
Summary: steam_socket_enable_crypto ignores verify_peer,
verify_peer_name and allow_self
Status: Feedback
Type: Bug
Package: OpenSSL related
Operating System: Elementary OS 0.4.1 Loki
PHP Version: 7.1.8
Block user comment: N
Private report: N
New Comment:
Does your actual certificate file include that meta data at the beginnig?
Bag Attributes
localKeyID: 00 11 22 33 44 55 66 77 88 99 AA BB CC DD EE FF 00 11 22 33
subject=/C=RU/ST=Moscow/O=Removed/OU=Removed/CN=Removed/emailAddress=removed@example.com
issuer=/C=RU/ST=Moscow/L=Moscow/O=Removed/OU=Removed/CN=www.example.org/emailAddress=removed@example.com
If so, please remove it and retry.
Previous Comments:
------------------------------------------------------------------------
[2017-08-18 09:01:54] root dot talis at gmail dot com
> Uhm, why do you set stream_context_set_option($context, 'ssl', 'ciphers',
> 'SSLv3')?
>
> It's pretty likely that the other side will not accept any of these, see https://www.openssl.org/docs/man1.0.2/apps/ciphers.html
> for a list of ciphers that 'SSLv3' includes.
>
> What happens if you remove that line? Might be that it's just showing the wrong error
> message.
Thank you for your reply!
Nothing changes if I remove that line, I still get the same warning. This code works on PHP 7.1.3
with that line in place.
------------------------------------------------------------------------
[2017-08-17 12:52:08] daverandom@php.net
Not enough information was provided for us to be able
to handle this bug. Please re-read the instructions at
http://bugs.php.net/how-to-report.php
If you can provide more information, feel free to add it
to this bug and change the status back to "Open".
Thank you for your interest in PHP.
Please note that the error in question is generated by the local_cert option and not by verify_peer,
verify_peer_name or allow_self_signed, see https://lxr.room11.org/xref/php-src%407.1/ext/openssl/xp_ssl.c#905
- if this step fails during initialisation of the SSL context, it will fail early before attempting
to initiate the SSL layer.
Please verify that your certificate file is in a format that is accepted by
SSL_CTX_use_certificate_chain_file() per https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_use_certificate_chain_file.html,
it must be PEM encoded.
------------------------------------------------------------------------
[2017-08-17 12:47:58] kelunik@php.net
Uhm, why do you set stream_context_set_option($context, 'ssl', 'ciphers',
'SSLv3')?
It's pretty likely that the other side will not accept any of these, see https://www.openssl.org/docs/man1.0.2/apps/ciphers.html
for a list of ciphers that 'SSLv3' includes.
What happens if you remove that line? Might be that it's just showing the wrong error message.
------------------------------------------------------------------------
[2017-08-17 12:37:02] root dot talis at gmail dot com
Description:
------------
I try to call stream_socket_enable_crypto() on an open connection with a self-signed certificate.
verify_peer is disabled, verify_peer_name is disabled, allow_self_signed is enabled,
but PHP throws the following warning:
"stream_socket_enable_crypto(): Unable to set local cert chain file `/tmp/admin.crt';
Check that your cafile/capath settings include details of your certificate and its issuer"
PHP is installed from this repository: https://launchpad.net/~ondrej/+archive/ubuntu/php
Unfortunately, I haven't found any information about the compile configure line.
I believe that the PPA maintainer can provide this information.
My setup:
PHP version: PHP 7.1.8-2+ubuntu16.04.1+deb.sury.org+4 (cli)
(built: Aug 4 2017 13:04:12) ( NTS )
OS: Elementary OS 0.4.1 Loki (based on Ubuntu Xenial)
OpenSSL version: OpenSSL 1.1.0f 25 May 2017
This is what my certificate metadata looks like (actual values replaced):
```
Bag Attributes
localKeyID: 00 11 22 33 44 55 66 77 88 99 AA BB CC DD EE FF 00 11 22 33
subject=/C=RU/ST=Moscow/O=Removed/OU=Removed/CN=Removed/emailAddress=removed@example.com
issuer=/C=RU/ST=Moscow/L=Moscow/O=Removed/OU=Removed/CN=www.example.org/emailAddress=removed@example.com
-----BEGIN CERTIFICATE-----
[certificate goes here]
```
I have reported this bug to the PPA bug tracker, and it's maintainer requested me to report
this bug here.
Original report URL: https://github.com/oerdnj/deb.sury.org/issues/661
Test script:
---------------
<?php
$address = gethostbyname('localhost');
$port = 443; // put any open port on any host here
$context = stream_context_create();
stream_context_set_option($context, 'ssl', 'capture_peer_cert', true);
stream_context_set_option($context, 'ssl', 'local_cert',
__DIR__.'/admin.crt');
stream_context_set_option($context, 'ssl', 'passphrase',
'yourCertPassword');
stream_context_set_option($context, 'ssl', 'ciphers', 'SSLv3');
stream_context_set_option($context, 'ssl', 'verify_peer', false);
stream_context_set_option($context, 'ssl', 'verify_peer_name', false);
stream_context_set_option($context, 'ssl', 'allow_self_signed', true);
$errno = null; $errstr = null;
$socket = stream_socket_client("tcp://$address:$port", $errno, $errstr, 30,
STREAM_CLIENT_CONNECT, $context);
stream_socket_enable_crypto($socket, true, STREAM_CRYPTO_METHOD_TLS_CLIENT);
Expected result:
----------------
Given that the certificate is correct, I expect no warnings to be thrown.
Actual result:
--------------
/usr/bin/php7.1 /tmp/test.php
PHP Warning: stream_socket_enable_crypto(): Unable to set local cert chain file
`/tmp/admin.crt'; Check that your cafile/capath settings include details of your certificate
and its issuer in /tmp/test.php on line 17
PHP Stack trace:
PHP 1. {main}() /tmp/test.php:0
PHP 2. stream_socket_enable_crypto() /tmp/test.php:17
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=75086&edit=1