Edit report at https://bugs.php.net/bug.php?id=76694&edit=1
ID: 76694
Comment by: anrdaemon at freemail dot ru
Reported by: anrdaemon at freemail dot ru
Summary: OpenSSL don't use Windows system CA store
Status: No Feedback
Type: Bug
Package: OpenSSL related
Operating System: Windows
PHP Version: 5.6.37
Block user comment: N
Private report: N
New Comment:
Yes, browsers that use system CA store (IE, Chrome-based) operate correctly.
Yes, I can use OpenSSL functionality (particularly curl) without an issue after pointing openssl.ca*
settings to Cygwin PKI that contains the necessary root CA certificate.
The further error message wasn't helping.
And no, it doesn't work with packagist either.
<?php
print file_get_contents(__FILE__);
var_dump(PHP_VERSION);
var_dump(ini_get("openssl.cafile"));
var_dump(ini_get("openssl.capath"));
file_get_contents('https://packagist.org/');
?>
string(6) "7.1.22"
string(0) ""
string(0) ""
PHP Warning: file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages:
error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed in
...\76694-openssl-system-PKI\test.php on line 6
PHP Warning: file_get_contents(): Failed to enable crypto in ...\76694-openssl-system-PKI\test.php
on line 6
PHP Warning: file_get_contents(https://packagist.org/): failed to open stream: operation failed in
...\76694-openssl-system-PKI\test.php on line 6
Previous Comments:
------------------------------------------------------------------------
[2018-11-19 10:27:13] nikic@php.net
The report was suspended because no response was provided to the questions that were asked by
@daverandom. The issue can be reopened once requested feedback is provided.
------------------------------------------------------------------------
[2018-11-19 10:09:16] anrdaemon at freemail dot ru
So, the report was suspended based on semi-educated guess? Without actual investigation?
I knew bugs.php.net tend to be like that, but not on such a scale.
------------------------------------------------------------------------
[2018-11-18 22:31:27] cmb@php.net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
------------------------------------------------------------------------
[2018-08-02 13:53:40] daverandom@php.net
This is just a semi-educated guess, but note that a self-signed certificate will only be accepted if
the allow_self_signed context option is set, regardless of whether it exists in the trusted root CA
store. Similarly, the verify_depth context option is still respected when the system store is used.
If the problematic certificate does not fall foul of either of these factors, please check the
following:
- Are you able to load the resource in a browser that uses the system CA store, on the same client
machine, without errors?
- If you specify a cafile that contains the relevant root certificate (i.e. use the openssl verify
routine), does it work?
- Where the system store-based verify routine encounters an operational failure of some kind it will
emit an E_WARNING with a descriptive message, please ensure that you have error reporting configured
with a sufficient level and include any logged messages here.
Although there aren't currently any proper tests for this code path - something which most
certainly needs addressing - it is fairly well tested in practice, simply by real-world usage. For
example, if file_get_contents('https://packagist.org/...') didn't work out of
the box on windows then there would be frequent reports as composer would not work.
If you want to discuss directly with me further in chat, you can find in the PHP chat room on Stack
Overflow most of the time, under the screen name DaveRandom :-)
------------------------------------------------------------------------
[2018-08-02 13:01:40] anrdaemon at freemail dot ru
Description:
------------
Contrary to the release announce of PHP 5.6
- OpenSSL:
. Fallback to Windows CA cert store for peer verification if no openssl.cafile
ini directive or "cafile" SSL context option specified in Windows.
(Chris Wright)
file_get_contents('https://ca.rootdir.org/');
fails with certificate verification error.
This is for all PHP versions from 5.6 to 7.2
Test script:
---------------
<?php
print file_get_contents('https://ca.rootdir.org/');
Expected result:
----------------
<html>
<body>
<h1>Hi!</h1>
<p><a href="ca.cer">Root certificate.</a></p>
</body>
</html>
Actual result:
--------------
PHP Warning: file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages:
error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed in
ssl-verify.php on line 3
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=76694&edit=1