| 
        php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login | 
 PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits             
             [2025-02-06 14:37 UTC] bukka@php.net
 
-Status:      Open
+Status:      Not a bug
-Assigned To:
+Assigned To: bukka
  [2025-02-06 14:37 UTC] bukka@php.net
  | 
    |||||||||||||||||||||||||||||||||||||
            
                 
                Copyright © 2001-2025 The PHP GroupAll rights reserved.  | 
        Last updated: Tue Nov 04 09:00:01 2025 UTC | 
Description: ------------ Using the test code below, I am able to open a SSL connection to a RabbitMQ server if the cert file has only 2 certificates (the client certificate and one intermediate certificate) but not if it contains the full chain of certificates (client cert, 3 intermediates and the root) provided by the CA (my use case is a wildcard certificate provided by Sectigo). The problem might be related to some implementation detail of RabbitMQ (software written in Erlang) because I am able to connect to a `openssl s_server` with the full chain. But at the same time, I am also able to connect to the RabbitMQ server with the full chain from a `openssl s_client` and from a Ruby client. To recap: PHP client (fullchain) -> RabbitMQ ===> KO! PHP client (shortchain) -> RabbitMQ ===> OK PHP client (fullchain) -> openssl s_server ===> OK openssl s_client (full) -> RabbitMQ ===> OK Ruby client (fullchain) -> RabbitMQ ===> OK So whatever this implementation detail might be, other clients are able to handle it. Test script: --------------- <?php $context = stream_context_create([ 'ssl' => [ 'local_cert' => 'full-chain.pem', 'local_pk' => 'key.pem', ], ]); $errno = NULL; $errstr = NULL; $sock = stream_socket_client( 'tcp://rabbitmq.domain.tld:5671', $errno, $errstr, 3, STREAM_CLIENT_CONNECT, $context ); stream_set_blocking($sock, true); stream_socket_enable_crypto($sock, true, STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT); Expected result: ---------------- No output. I should be able to use the full chain since the server may not have the intermediate certificates in its trusted store. Actual result: -------------- PHP Warning: stream_socket_client(): SSL operation failed with code 1. OpenSSL Error messages: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure There is no SSL handshake-related output in the server logs