Bug #75086 [Fbk->NoF]: steam_socket_enable_crypto ignores verify_peer, verify_peer_name and allow_self

Edit report at https://bugs.php.net/bug.php?id=75086&edit=1 ID: 75086 Updated by: php-bugs@lists.php.net Reported by: root dot talis at gmail dot com Summary: steam_socket_enable_crypto ignores verify_peer, verify_peer_name and allow_self -Status: Feedback +Status: No Feedback Type: Bug Package: OpenSSL related Operating System: Elementary OS 0.4.1 Loki PHP Version: 7.1.8 Private report: N New Comment: No feedback was provided. The bug is being suspended because we assume that you are no longer experiencing the problem. If this is not the case and you are able to provide the information that was requested earlier, please do so and change the status of the bug back to "Re-Opened". Thank you. Previous Comments: ------------------------------------------------------------------------ [2017-08-21 08:57:52] root dot talis at gmail dot com I managed to make a build of PHP-7.1.8 with OpenSSL 1.0.2g instead of 1.1.0f that doesn't have this issue. ------------------------------------------------------------------------ [2017-08-18 09:43:45] root dot talis at gmail dot com > Does your actual certificate file include that meta data at the beginnig? > > Bag Attributes > localKeyID: 00 11 22 33 44 55 66 77 88 99 AA BB CC DD EE FF 00 11 22 33 subject=/C=RU/ST=Moscow/O=Removed/OU=Removed/CN=Removed/emailAddress=removed@example.com > > issuer=/C=RU/ST=Moscow/L=Moscow/O=Removed/OU=Removed/CN=www.example.org/emailAddress=removed@example.com > > > If so, please remove it and retry. Yes, it does. Removing the data didn't help. ------------------------------------------------------------------------ [2017-08-18 09:35:54] kelunik@php.net Does your actual certificate file include that meta data at the beginnig? Bag Attributes localKeyID: 00 11 22 33 44 55 66 77 88 99 AA BB CC DD EE FF 00 11 22 33 subject=/C=RU/ST=Moscow/O=Removed/OU=Removed/CN=Removed/emailAddress=removed@example.com issuer=/C=RU/ST=Moscow/L=Moscow/O=Removed/OU=Removed/CN=www.example.org/emailAddress=removed@example.com If so, please remove it and retry. ------------------------------------------------------------------------ [2017-08-18 09:01:54] root dot talis at gmail dot com > Uhm, why do you set stream_context_set_option($context, 'ssl', 'ciphers', > 'SSLv3')? > > It's pretty likely that the other side will not accept any of these, see > https://www.openssl.org/docs/man1.0.2/apps/ciphers.html for a list > of ciphers that 'SSLv3' includes. > > What happens if you remove that line? Might be that it's just showing the wrong error > message. Thank you for your reply! Nothing changes if I remove that line, I still get the same warning. This code works on PHP 7.1.3 with that line in place. ------------------------------------------------------------------------ [2017-08-17 12:52:08] daverandom@php.net Not enough information was provided for us to be able to handle this bug. Please re-read the instructions at http://bugs.php.net/how-to-report.php If you can provide more information, feel free to add it to this bug and change the status back to "Open". Thank you for your interest in PHP. Please note that the error in question is generated by the local_cert option and not by verify_peer, verify_peer_name or allow_self_signed, see https://lxr.room11.org/xref/php-src%407.1/ext/openssl/xp_ssl.c#905 - if this step fails during initialisation of the SSL context, it will fail early before attempting to initiate the SSL layer. Please verify that your certificate file is in a format that is accepted by SSL_CTX_use_certificate_chain_file() per https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_use_certificate_chain_file.html, it must be PEM encoded. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=75086 -- Edit this bug report at https://bugs.php.net/bug.php?id=75086&edit=1