Edit report at https://bugs.php.net/bug.php?id=76694&edit=1
ID: 76694
Updated by: cmb@php.net
Reported by: anrdaemon at freemail dot ru
Summary: OpenSSL don't use Windows system CA store
-Status: Assigned
+Status: Analyzed
Type: Bug
Package: OpenSSL related
Operating System: Windows
PHP Version: 5.6.37
Assigned To: cmb
Block user comment: N
Private report: N
New Comment:
Okay, the problem is that we only check the subject CN (which is
"Rootdir CA webserver"), but not the subjectAltNames (which have
the required "ca.rootdir.org").
Previous Comments:
------------------------------------------------------------------------
[2021-05-25 11:36:52] cmb@php.net
The Windows CA cert store is definitely used (not yet sure if 100%
correctly), but currently https://ca.rootdir.org/ca.cer
is
apparently down.
------------------------------------------------------------------------
[2021-05-24 11:39:42] cmb@php.net
Thanks! I'll have a closer look.
------------------------------------------------------------------------
[2021-05-24 09:39:29] anrdaemon at yandex dot ru
> Well, requesting https://packagist.org works for me with
> and without setting openssl.cacert,
Because its CA was added to the internal bundle since then.
> but requesting https://ca.rootdir.org/ does not even work
> from a browser (NET::ERR_CERT_AUTHORITY_INVALID).
Why invalid? Should be "issuer unknown". Add https://ca.rootdir.org/ca.cer to your system PKI.
> So maybe this has been fixed in the meantime. Or do you still experience the issue with any of
> the actively supported PHP versions[1].
Tested with PHP 7.4, nothing changed.
<?php
print file_get_contents(__FILE__);
var_dump(PHP_VERSION);
var_dump(ini_get("openssl.cafile"));
var_dump(ini_get("openssl.capath"));
var_dump(substr(file_get_contents('https://ca.rootdir.org/'), 0, 16));
var_dump(error_get_last());
With Cygwin PKI:
<?php
print file_get_contents(__FILE__);
var_dump(PHP_VERSION);
var_dump(ini_get("openssl.cafile"));
var_dump(ini_get("openssl.capath"));
var_dump(substr(file_get_contents('https://ca.rootdir.org/'), 0, 16));
var_dump(error_get_last());
string(6) "7.4.16"
string(76) "C:\Programs\Cygwin_64\etc\pki\ca-trust\extracted\openssl\ca-bundle.trust.crt"
string(35) "C:\Programs\Cygwin_64\usr\ssl\certs"
string(16) "<html>
<body>
<h"
NULL
Without specific PKI:
<?php
print file_get_contents(__FILE__);
var_dump(PHP_VERSION);
var_dump(ini_get("openssl.cafile"));
var_dump(ini_get("openssl.capath"));
var_dump(substr(file_get_contents('https://ca.rootdir.org/'), 0, 16));
var_dump(error_get_last());
string(6) "7.4.16"
string(0) ""
string(0) ""
string(0) ""
array(4) {
["type"]=>
int(2)
["message"]=>
string(83) "file_get_contents(https://ca.rootdir.org/): failed to open stream: operation
failed"
["file"]=>
string(71) "C:\Users\anrdaemon\Documents\Bugs\PHP\76694-openssl-system-PKI\test.php"
["line"]=>
int(6)
}
------------------------------------------------------------------------
[2021-05-09 04:22:08] php-bugs at lists dot php dot net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
------------------------------------------------------------------------
[2021-04-29 12:41:53] cmb@php.net
Well, requesting https://packagist.org works for me with and
without setting openssl.cacert, but requesting
https://ca.rootdir.org/ does not even work from a browser
(NET::ERR_CERT_AUTHORITY_INVALID).
So maybe this has been fixed in the meantime. Or do you still
experience the issue with any of the actively supported PHP
versions[1].
[1] <https://www.php.net/supported-versions.php>
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=76694
--
Edit this bug report at https://bugs.php.net/bug.php?id=76694&edit=1