note 128941 added to function.openssl-pkcs12-read

Since OpenSSL 3, this function will fail with .p12 files that use legacy ciphers. Unfortunately, .p12 files generated today from a lot of Windows based CAs are using them by default. OpenSSL 3 uses a provider mechanism where there is a legacy provider that supports these legacy ciphers, but it is disabled by default. While PHP SSL module lacks a mechanism to enable the legacy provider, you need to modify the openssl.conf used by PHP by hand, it is usually the same used by the system openssl command, so the OPENSSLDIR path value returned by the "openssl version -d" command contains the openssl.conf file to modify. The llines that need to be added, modified or uncommented are the following to look like this: openssl_conf = openssl_init [openss_init] providers = provider_sect [provider_sect] default = default_sect legacy = legacy_sect [default_sect] activate = 1 [legacy_sect] activate = 1 This may require restarting the involved php service (php-fpm usually) to load the OpenSSL configuration changes. ---- Server IP: 45.112.84.4 Probable Submitter: 45.91.157.134 (proxied: 2803:5180:4100:200::2) ---- Manual Page -- https://php.net/manual/en/function.openssl-pkcs12-read.php Edit -- https://main.php.net/note/edit/128941 Del: integrated -- https://main.php.net/note/delete/128941/integrated Del: useless -- https://main.php.net/note/delete/128941/useless Del: bad code -- https://main.php.net/note/delete/128941/bad+code Del: spam -- https://main.php.net/note/delete/128941/spam Del: non-english -- https://main.php.net/note/delete/128941/non-english Del: in docs -- https://main.php.net/note/delete/128941/in+docs Del: other reasons-- https://main.php.net/note/delete/128941 Reject -- https://main.php.net/note/reject/128941 Search -- https://main.php.net/manage/user-notes.php