|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #63992 php not use default openSSH confing
Submitted: 2013-01-15 14:51 UTC Modified: 2021-01-12 17:55 UTC
Avg. Score:4.1 ± 0.9
Reproduced:14 of 15 (93.3%)
Same Version:10 (71.4%)
Same OS:8 (57.1%)
From: mikhail dot v dot gavrilov at gmail dot com Assigned: cmb (profile)
Status: Closed Package: OpenSSL related
PHP Version: 5.4.11RC1 OS: RHEL/Fedora
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Bug Type:
From: mikhail dot v dot gavrilov at gmail dot com
New email:
PHP Version: OS:


 [2013-01-15 14:51 UTC] mikhail dot v dot gavrilov at gmail dot com
For using GOST encryption engine:
1. i compiled openSSH with GOST support
2. added the following lines in openssl.cnf

openssl_conf = openssl_def

engines = engine_section

gost = gost_section

engine_id = gost
default_algorithms = ALL
dynamic_path = /usr/lib/openssl/engines/
CRYPT_PARAMS = id-Gost28147-89-CryptoPro-A-ParamSet

But when I use curl PHP still get error: 'Cannot communicate securely with peer: 
no common encryption algorithm(s).'

Than I search I find this solution:

So I create patch 

*** 111/openssl.c       2012-12-19 12:55:19.000000000 +0600                                                                                                   
--- openssl.c   2013-01-15 18:43:22.000000000 +0600                                                                                                           
*** 1038,1043 ****                                                                                                                                            
--- 1038,1046 ----                                                                                                                                            
        le_x509 = zend_register_list_destructors_ex(php_x509_free, NULL, 
"OpenSSL X.509", module_number);                                                     
        le_csr = zend_register_list_destructors_ex(php_csr_free, NULL, "OpenSSL 
X.509 CSR", module_number);                                                   
+       /* needed for use default config */                                                                                                                   
+       OPENSSL_config(NULL);                                                                                                                                 

and my script became work.

Test script:
// $proxy = '';
$xml = '';

$ch = curl_init($address);
$page = "Xml.php";
$headers = array(
	"POST ".$page." HTTP/1.0",
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_POSTFIELDS, $xml);
if(isset($proxy)) curl_setopt($ch, CURLOPT_PROXY, $proxy);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

$response = curl_exec($ch);if ($response === false) throw new Exception(curl_error($ch));


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2013-01-15 15:21 UTC]
-Status: Open +Status: Assigned -Assigned To: +Assigned To: pajoye
 [2013-01-25 15:03 UTC]
A quick comment about the patch, using this function may affect anything using 
openssl within the same process, that's really not good.

Also, in case of curl, curl should take care of that, using options.
 [2013-02-05 18:32 UTC] mikhail dot v dot gavrilov at gmail dot com
Pierre, do you think what initialization openSSL into each extension good idea? I 
think better if it will be do openssl extension for all other extensions. So I 
couldn't find OPENSSL_config(NULL); into openssl extension code and I very 
surprised and don't understand how it work. I just tried add 
OPENSSL_config(NULL); before SSL_library_init(); string and it really helped me 
solved problem with curl.
 [2013-02-05 18:46 UTC]
There are much more in the same process than only PHP extensions. Libraries, 
servers, etc. also rely on OpenSSL.
 [2013-02-05 18:55 UTC] mikhail dot v dot gavrilov at gmail dot com
I am tell about php-fpm. In this case only PHP and PHP extension's in the same 
 [2013-02-18 03:30 UTC] mikhail dot v dot gavrilov at gmail dot com
Pierre, are you still think that OpenSSL config init must do curl by itself? But 
but curl may use not only openSSL, also it may use NSS.
 [2013-06-19 14:47 UTC] mikhail dot v dot gavrilov at gmail dot com
Pierre, please look this curl bug
Seems our problem relate with this.
 [2017-10-24 07:37 UTC]
-Status: Assigned +Status: Open -Assigned To: pajoye +Assigned To:
 [2021-01-12 17:55 UTC]
-Status: Open +Status: Closed -Assigned To: +Assigned To: cmb
 [2021-01-12 17:55 UTC]
This is fixed[1] as of PHP 7.2.0.

[1] <>
PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Thu Dec 02 00:03:42 2021 UTC