Edit report at https://bugs.php.net/bug.php?id=76694&edit=1
ID: 76694
Patch added by: cmb@php.net
Reported by: anrdaemon at freemail dot ru
Summary: native Windows cert verification uses CN as sever
name
Status: Analyzed
Type: Bug
Package: OpenSSL related
Operating System: Windows
PHP Version: 5.6.37
Assigned To: cmb
Block user comment: N
Private report: N
New Comment:
The following pull request has been associated:
Patch Name: Fix #76694: native Windows cert verification uses CN as sever name
On GitHub: https://github.com/php/php-src/pull/7060
Patch: https://github.com/php/php-src/pull/7060.patch
Previous Comments:
------------------------------------------------------------------------
[2021-05-26 15:20:07] cmb@php.net
Okay, the problem is that we only check the subject CN (which is
"Rootdir CA webserver"), but not the subjectAltNames (which have
the required "ca.rootdir.org").
------------------------------------------------------------------------
[2021-05-25 11:36:52] cmb@php.net
The Windows CA cert store is definitely used (not yet sure if 100%
correctly), but currently https://ca.rootdir.org/ca.cer
is
apparently down.
------------------------------------------------------------------------
[2021-05-24 11:39:42] cmb@php.net
Thanks! I'll have a closer look.
------------------------------------------------------------------------
[2021-05-24 09:39:29] anrdaemon at yandex dot ru
> Well, requesting https://packagist.org works for me with
> and without setting openssl.cacert,
Because its CA was added to the internal bundle since then.
> but requesting https://ca.rootdir.org/ does not even work
> from a browser (NET::ERR_CERT_AUTHORITY_INVALID).
Why invalid? Should be "issuer unknown". Add https://ca.rootdir.org/ca.cer to your system PKI.
> So maybe this has been fixed in the meantime. Or do you still experience the issue with any of
> the actively supported PHP versions[1].
Tested with PHP 7.4, nothing changed.
<?php
print file_get_contents(__FILE__);
var_dump(PHP_VERSION);
var_dump(ini_get("openssl.cafile"));
var_dump(ini_get("openssl.capath"));
var_dump(substr(file_get_contents('https://ca.rootdir.org/'), 0, 16));
var_dump(error_get_last());
With Cygwin PKI:
<?php
print file_get_contents(__FILE__);
var_dump(PHP_VERSION);
var_dump(ini_get("openssl.cafile"));
var_dump(ini_get("openssl.capath"));
var_dump(substr(file_get_contents('https://ca.rootdir.org/'), 0, 16));
var_dump(error_get_last());
string(6) "7.4.16"
string(76) "C:\Programs\Cygwin_64\etc\pki\ca-trust\extracted\openssl\ca-bundle.trust.crt"
string(35) "C:\Programs\Cygwin_64\usr\ssl\certs"
string(16) "<html>
<body>
<h"
NULL
Without specific PKI:
<?php
print file_get_contents(__FILE__);
var_dump(PHP_VERSION);
var_dump(ini_get("openssl.cafile"));
var_dump(ini_get("openssl.capath"));
var_dump(substr(file_get_contents('https://ca.rootdir.org/'), 0, 16));
var_dump(error_get_last());
string(6) "7.4.16"
string(0) ""
string(0) ""
string(0) ""
array(4) {
["type"]=>
int(2)
["message"]=>
string(83) "file_get_contents(https://ca.rootdir.org/): failed to open stream: operation
failed"
["file"]=>
string(71) "C:\Users\anrdaemon\Documents\Bugs\PHP\76694-openssl-system-PKI\test.php"
["line"]=>
int(6)
}
------------------------------------------------------------------------
[2021-05-09 04:22:08] php-bugs at lists dot php dot net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=76694
--
Edit this bug report at https://bugs.php.net/bug.php?id=76694&edit=1