|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #63992 php not use default openSSH confing
Submitted: 2013-01-15 14:51 UTC Modified: 2017-10-24 07:37 UTC
Avg. Score:4.1 ± 0.9
Reproduced:14 of 15 (93.3%)
Same Version:10 (71.4%)
Same OS:8 (57.1%)
From: mikhail dot v dot gavrilov at gmail dot com Assigned:
Status: Open Package: OpenSSL related
PHP Version: 5.4.11RC1 OS: RHEL/Fedora
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Bug Type:
From: mikhail dot v dot gavrilov at gmail dot com
New email:
PHP Version: OS:


 [2013-01-15 14:51 UTC] mikhail dot v dot gavrilov at gmail dot com
For using GOST encryption engine:
1. i compiled openSSH with GOST support
2. added the following lines in openssl.cnf

openssl_conf = openssl_def

engines = engine_section

gost = gost_section

engine_id = gost
default_algorithms = ALL
dynamic_path = /usr/lib/openssl/engines/
CRYPT_PARAMS = id-Gost28147-89-CryptoPro-A-ParamSet

But when I use curl PHP still get error: 'Cannot communicate securely with peer: 
no common encryption algorithm(s).'

Than I search I find this solution:

So I create patch 

*** 111/openssl.c       2012-12-19 12:55:19.000000000 +0600                                                                                                   
--- openssl.c   2013-01-15 18:43:22.000000000 +0600                                                                                                           
*** 1038,1043 ****                                                                                                                                            
--- 1038,1046 ----                                                                                                                                            
        le_x509 = zend_register_list_destructors_ex(php_x509_free, NULL, 
"OpenSSL X.509", module_number);                                                     
        le_csr = zend_register_list_destructors_ex(php_csr_free, NULL, "OpenSSL 
X.509 CSR", module_number);                                                   
+       /* needed for use default config */                                                                                                                   
+       OPENSSL_config(NULL);                                                                                                                                 

and my script became work.

Test script:
// $proxy = '';
$xml = '';

$ch = curl_init($address);
$page = "Xml.php";
$headers = array(
	"POST ".$page." HTTP/1.0",
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_POSTFIELDS, $xml);
if(isset($proxy)) curl_setopt($ch, CURLOPT_PROXY, $proxy);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

$response = curl_exec($ch);if ($response === false) throw new Exception(curl_error($ch));


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2013-01-15 15:21 UTC]
-Status: Open +Status: Assigned -Assigned To: +Assigned To: pajoye
 [2013-01-25 15:03 UTC]
A quick comment about the patch, using this function may affect anything using 
openssl within the same process, that's really not good.

Also, in case of curl, curl should take care of that, using options.
 [2013-02-05 18:32 UTC] mikhail dot v dot gavrilov at gmail dot com
Pierre, do you think what initialization openSSL into each extension good idea? I 
think better if it will be do openssl extension for all other extensions. So I 
couldn't find OPENSSL_config(NULL); into openssl extension code and I very 
surprised and don't understand how it work. I just tried add 
OPENSSL_config(NULL); before SSL_library_init(); string and it really helped me 
solved problem with curl.
 [2013-02-05 18:46 UTC]
There are much more in the same process than only PHP extensions. Libraries, 
servers, etc. also rely on OpenSSL.
 [2013-02-05 18:55 UTC] mikhail dot v dot gavrilov at gmail dot com
I am tell about php-fpm. In this case only PHP and PHP extension's in the same 
 [2013-02-18 03:30 UTC] mikhail dot v dot gavrilov at gmail dot com
Pierre, are you still think that OpenSSL config init must do curl by itself? But 
but curl may use not only openSSL, also it may use NSS.
 [2013-06-19 14:47 UTC] mikhail dot v dot gavrilov at gmail dot com
Pierre, please look this curl bug
Seems our problem relate with this.
 [2017-10-24 07:37 UTC]
-Status: Assigned +Status: Open -Assigned To: pajoye +Assigned To:
PHP Copyright © 2001-2020 The PHP Group
All rights reserved.
Last updated: Wed Oct 21 08:01:23 2020 UTC