Analysis and Solutions for PHP 5.6 SSL Certificate Verification Issues

Problem Background and Error Analysis

In PHP development, using the file_get_contents function to access HTTPS resources is a common practice. However, after upgrading to PHP 5.6, many developers encountered SSL certificate verification failures. The specific error messages typically appear as:

Warning: file_get_contents(): SSL operation failed with code 1.
OpenSSL Error messages: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Warning: file_get_contents(): Failed to enable crypto
Warning: file_get_contents(): failed to open stream: operation failed

These errors indicate that certificate verification failed during the SSL handshake process. It's noteworthy that this issue may not occur when accessing certain well-known websites (like Google), because these sites typically use SSL certificates included in the system's default CA certificate bundle.

PHP 5.6 SSL Verification Mechanism Changes

PHP 5.6 introduced significant improvements to SSL/TLS handling, enabling peer certificate verification by default. According to the official migration documentation, the main changes include:

• Default enabling of the verify_peer option
• Default enabling of the verify_peer_name option
• Requirement for valid CA certificate bundles for verification

These enhancements improve security but also cause compatibility issues, particularly when accessing services using self-signed certificates or incomplete certificate chains.

Solution 1: Disabling SSL Verification

For development environments or internal systems, SSL verification can be temporarily disabled to resolve the issue:

<?php
$arrContextOptions = array(
    "ssl" => array(
        "verify_peer" => false,
        "verify_peer_name" => false,
    ),
);

$response = file_get_contents(
    "https://maps.co.weber.ut.us/arcgis/rest/services/SDE_composite_locator/GeocodeServer/findAddressCandidates?Street=&SingleLine=3042+N+1050+W&outFields=*&outSR=102100&searchExtent=&f=json",
    false,
    stream_context_create($arrContextOptions)
);

echo $response;
?>

Security Warning: This method disables all SSL certificate verification, creating a risk of man-in-the-middle attacks. Avoid using this in production environments.

Solution 2: Using CA Certificate Bundles

A more secure solution involves configuring the correct CA certificate bundle:

<?php
$arrContextOptions = [
    'ssl' => [
        'cafile' => '/path/to/bundle/cacert.pem',
        'verify_peer' => true,
        'verify_peer_name' => true,
    ],
];

$response = file_get_contents(
    'https://maps.co.weber.ut.us/arcgis/rest/services/SDE_composite_locator/GeocodeServer/findAddressCandidates?Street=&SingleLine=3042+N+1050+W&outFields=*&outSR=102100&searchExtent=&f=json',
    false,
    stream_context_create($arrContextOptions)
);
?>

The latest CA certificate bundle can be downloaded from the cURL website, ensuring it includes the root certificates used by the target website.

Special Handling in Chroot Environments

In chroot jail environments, system files may be inaccessible. As mentioned in the reference article, when users are restricted to chroot environments, even with correct CA certificate paths configured, access to system certificate bundles may be prevented due to filesystem isolation.

Solutions include:

• Copying CA certificate bundles into the chroot environment
• Using the jk_cp command to manage files within chroot environments
• Configuring include paths in Webmin's Jailkit Jail Manager

Specific implementation requires adjustment based on the particular chroot configuration, ensuring PHP processes can access necessary certificate files.

Best Practice Recommendations

Based on the above analysis, the following best practices are recommended:

1. Development Environment: Use verification disabling for quick problem resolution, but remain aware of security risks
2. Production Environment: Always use valid CA certificate bundles to ensure proper SSL verification
3. Certificate Management: Regularly update CA certificate bundles to include the latest root certificates
4. Error Handling: Implement appropriate exception handling in code to gracefully manage SSL verification failures
5. Environment Configuration: Ensure necessary system files are accessible in chroot or containerized environments

Conclusion

While PHP 5.6's SSL verification improvements provide better security, they also increase configuration complexity. By understanding how SSL verification mechanisms work, developers can choose appropriate solutions. In most cases, using the correct CA certificate bundle is the optimal choice, ensuring both security and functional reliability. For special environments like chroot jails, additional configuration steps are necessary to guarantee accessibility of system components.