[Bug]: openssl extension doesn't work

[deleugpn]

Operating system version

13.4.1 (c) (22F770820d)

System architecture

ARM64 (M1, M2, etc)

Herd Version

1.2.0 (Build: 14)

PHP Version

PHP 8.2.9 (cli) (built: Aug 22 2023 13:42:30) (NTS)

Bug description

Openssl extensions are not working due to some lack of connection with the system library.

Steps to reproduce

php -a
Interactive shell

php > var_dump(openssl_pkey_new());
bool(false)

php > var_dump(openssl_error_string());
string(64) "error:FFFFFFFF80000002:system library::No such file or directory"

Relevant log output

string(64) "error:FFFFFFFF80000002:system library::No such file or directory"

[mpociot]

Thanks for reporting this.
The issue is that Herd's PHP binary does include OpenSSL, but it does not include the openssl.cnf file which is required for these methods to work (see the PHP documentation).

You can fix this locally by manually downloading the openssl.cnf file from the OpenSSL repository: https://github.com/openssl/openssl/blob/bd3b026faab3b5ee5aa6b52ba6eb4080bc144b28/apps/openssl.cnf#L4

Store this for example in your ~/Library/Application Support/Herd/config/php directory and add the following environment variable to your bashrc/zshrc file:

OPENSSL_CONF=/Users/[YOUR-USERNAME]/Library/Application Support/Herd/config/php/openssl.cnf

This fixes the issue when using PHP via the CLI.

In order to fix this via FPM, we will need to modify Herd.
I'll leave this issue open so that we can close it once this has been added in the next update.

[pxlrbt]

Maybe stuff like this can be added to the Troubleshooting section on the docs as "Known issue" or similar when there is an existing workaround?

[dasundev]

After searching for some time, I found this issue that helped me understand why I couldn't fix this error on my own.

@mpociot I believe this issue will be resolved soon because I'm using Laravel Herd for my development.

However, I've had to temporarily stop working on my project until the issue is fixed.

[deleugpn]

Just one additional note. It might be good if Herd could try or default to /etc/ssl/openssl.cnf. I have OpenSSL installed locally and the configuration is already available there. All I had to do was OPENSSL_CONF=/etc/ssl/openssl.cnf php artisan and it worked. It seems like a better default than the /ssl/openssl.cnf that ships with Herd given this is a Macbook application.

[p4bl1t0]

Have anyone find a workaround to fill FPM herd with an OpenSSL cnf file?

[dasundev]

@p4bl1t0 Still waiting for the Herd update.

[p4bl1t0]

@mpociot are there any update? Or can you help us to find a workaround?

I'm not able to create the /ssl/openssl.cnf because /ssl doesn't exist and / is read-only.

[Log1x]

Can the path just get changed to /etc/ssl/openssl.cnf for FPM and CLI for now? No possible workaround for FPM is a little painful.

[SaaberDev]

@mpociot

is there any way to use it from homebrew for now ?

[pxlrbt]

I copied the openssl.conf and set the env var, but I am still getting an error for artisan package:discover:

file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages:
error:0A000086:SSL routines::certificate verify failed

Because of this lines:

 at app/Console/Kernel.php:46
     42▕      */
     43▕     protected function schedule(Schedule $schedule): void
     44▕     {
     45▕         if (app()->environment('production')) {
  ➜  46▕             file_get_contents('https://cronitor.link/p/xxx/yyyy');

[mpociot]

The openssl.cnf file will now be auto-discovered from your system configuration.