diff -uN /etc/ssl/openssl.cnf\~original /etc/ssl/openssl.cnf for Nextcloud with OpenSSL 3

openssl.cnf.diff

--- /etc/ssl/openssl.cnf~original	2022-03-16 08:35:51.000000000 +0000
+++ /etc/ssl/openssl.cnf	2022-05-04 02:37:30.336530711 +0000
@@ -56,6 +56,7 @@
 # List of providers to load
 [provider_sect]
 default = default_sect
+legacy = legacy_sect
 # The fips section name should match the section name inside the
 # included fipsmodule.cnf.
 # fips = fips_sect
@@ -69,7 +70,9 @@
 # OpenSSL may not work correctly which could lead to significant system
 # problems including inability to remotely access the system.
 [default_sect]
-# activate = 1
+activate = 1
+[legacy_sect]
+activate = 1
 
 
 ####################################################################

After modifying the file, you need to restart the program that depends on OpenSSL. For example, if you are running Nextcloud with FPM on Ubuntu 22.04, you need to do systemctl restart php8.1-fpm.

Thank you, it saved my life

not working,help me !!!!!!!

Doesn't seem to work on Ubuntu 22.04 and OpenSSL 3.0.2 - do you have any more mentions of "legacy" in your config?

Thank you, it saved my life

Helped for openssl_pkcs12_read function start work properly.
But php -r "echo file_get_contents('https://chromedriver.storage.googleapis.com/LATEST_RELEASE', false, stream_context_create());" still producing warning.
ubuntu 22.04, php 8.1.6

Doesn't seem to work on Ubuntu 22.04 and OpenSSL 3.0.2 - do you have any more mentions of "legacy" in your config?

+1

This change exists but is commented out in the default openssl.conf file for Fedora 36:

##default = default_sect
##legacy = legacy_sect

##[default_sect]
##activate = 1

##[legacy_sect]
##activate = 1

Uncommenting and restarting Apache / php-fpm does not prevent the PHP error, at least when using CURL. Still getting:

 OpenSSL SSL_read: error:0A000126:SSL routines::unexpected eof while reading, errno 0

Didn't work for me even after nginx restart

same here
php -r "echo file_get_contents('https://chromedriver.storage.googleapis.com/LATEST_RELEASE', false, stream_context_create());"
give error also with this update, php restart and nginx restart

如何解决呢

src/event/ngx_event_openssl.c:902:9: error: ‘ENGINE_by_id’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
902 | engine = ENGINE_by_id((char *) p);
| ^~~~~~
In file included from src/event/ngx_event_openssl.h:22,
from src/core/ngx_core.h:89,
from src/event/ngx_event_openssl.c:9:
/usr/include/openssl/engine.h:336:31: note: declared here
336 | OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_by_id(const char *id);
| ^~~~~~~~~~~~
src/event/ngx_event_openssl.c:911:9: error: ‘ENGINE_load_private_key’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
911 | pkey = ENGINE_load_private_key(engine, (char *) last, 0, 0);
| ^~~~
In file included from src/event/ngx_event_openssl.h:22,
from src/core/ngx_core.h:89,
from src/event/ngx_event_openssl.c:9:
/usr/include/openssl/engine.h:638:11: note: declared here
638 | EVP_PKEY *ENGINE_load_private_key(ENGINE *e, const char *key_id,
| ^~~~~~~~~~~~~~~~~~~~~~~
src/event/ngx_event_openssl.c:915:13: error: ‘ENGINE_free’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
915 | ENGINE_free(engine);
| ^~~~~~~~~~~
In file included from src/event/ngx_event_openssl.h:22,
from src/core/ngx_core.h:89,
from src/event/ngx_event_openssl.c:9:
/usr/include/openssl/engine.h:493:27: note: declared here
493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e);
| ^~~~~~~~~~~
src/event/ngx_event_openssl.c:919:9: error: ‘ENGINE_free’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
919 | ENGINE_free(engine);
| ^~~~~~~~~~~
In file included from src/event/ngx_event_openssl.h:22,
from src/core/ngx_core.h:89,
from src/event/ngx_event_openssl.c:9:
/usr/include/openssl/engine.h:493:27: note: declared here
493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e);
| ^~~~~~~~~~~
src/event/ngx_event_openssl.c: In function ‘ngx_ssl_dhparam’:
src/event/ngx_event_openssl.c:1515:5: error: ‘PEM_read_bio_DHparams’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
1515 | dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
| ^~
In file included from /usr/include/openssl/ssl.h:36,
from src/event/ngx_event_openssl.h:15,
from src/core/ngx_core.h:89,
from src/event/ngx_event_openssl.c:9:
/usr/include/openssl/pem.h:469:1: note: declared here
469 | DECLARE_PEM_rw_attr(OSSL_DEPRECATEDIN_3_0, DHparams, DH)
| ^~~~~~~~~~~~~~~~~~~
src/event/ngx_event_openssl.c:1525:5: error: ‘DH_free’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
1525 | DH_free(dh);
| ^~~~~~~

如何解决呢
src/event/ngx_event_openssl.c:902:9: error: ‘ENGINE_by_id’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
902 | engine = ENGINE_by_id((char *) p);
| ^~~~~~
In file included from src/event/ngx_event_openssl.h:22,
from src/core/ngx_core.h:89,
from src/event/ngx_event_openssl.c:9:
/usr/include/openssl/engine.h:336:31: note: declared here
336 | OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_by_id(const char *id);
| ^~~~~~~~~~~~
src/event/ngx_event_openssl.c:911:9: error: ‘ENGINE_load_private_key’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
911 | pkey = ENGINE_load_private_key(engine, (char *) last, 0, 0);
| ^~~~
In file included from src/event/ngx_event_openssl.h:22,
from src/core/ngx_core.h:89,
from src/event/ngx_event_openssl.c:9:
/usr/include/openssl/engine.h:638:11: note: declared here
638 | EVP_PKEY *ENGINE_load_private_key(ENGINE *e, const char *key_id,
| ^~~~~~~~~~~~~~~~~~~~~~~
src/event/ngx_event_openssl.c:915:13: error: ‘ENGINE_free’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
915 | ENGINE_free(engine);
| ^~~~~~~~~~~
In file included from src/event/ngx_event_openssl.h:22,
from src/core/ngx_core.h:89,
from src/event/ngx_event_openssl.c:9:
/usr/include/openssl/engine.h:493:27: note: declared here
493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e);
| ^~~~~~~~~~~
src/event/ngx_event_openssl.c:919:9: error: ‘ENGINE_free’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
919 | ENGINE_free(engine);
| ^~~~~~~~~~~
In file included from src/event/ngx_event_openssl.h:22,
from src/core/ngx_core.h:89,
from src/event/ngx_event_openssl.c:9:
/usr/include/openssl/engine.h:493:27: note: declared here
493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e);
| ^~~~~~~~~~~
src/event/ngx_event_openssl.c: In function ‘ngx_ssl_dhparam’:
src/event/ngx_event_openssl.c:1515:5: error: ‘PEM_read_bio_DHparams’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
1515 | dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
| ^~
In file included from /usr/include/openssl/ssl.h:36,
from src/event/ngx_event_openssl.h:15,
from src/core/ngx_core.h:89,
from src/event/ngx_event_openssl.c:9:
/usr/include/openssl/pem.h:469:1: note: declared here
469 | DECLARE_PEM_rw_attr(OSSL_DEPRECATEDIN_3_0, DHparams, DH)
| ^~~~~~~~~~~~~~~~~~~
src/event/ngx_event_openssl.c:1525:5: error: ‘DH_free’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
1525 | DH_free(dh);
| ^~~~~~~

This isn't working for me either. Anyone has solved it? My environment is Ubuntu 22.04, PHP 8.1.2 and Apache2

Thanks @rdh27785, you saved my life!

same here

php -r "echo file_get_contents('https://chromedriver.storage.googleapis.com/LATEST_RELEASE', false, stream_context_create());"

give error

@eliosh , try updating your system. apt update, apt upgrade will update php minor version that fixed it for me

This isn't working for me either. Anyone has solved it? My environment is Ubuntu 22.04, PHP 8.1.2 and Apache2

+1

Thank you so much it worked! on Ubuntu 22.04, PHP 7.4, nginx

I'd say that it's working for me on PHP, but not on Postfix. Oh well. It was worth a try, I guess!

Doesn't seem to work on Ubuntu 22.04 and OpenSSL 3.0.2 - do you have any more mentions of "legacy" in your config?

+1 here... any thoughts?

php -r "echo file_get_contents('https://chromedriver.storage.googleapis.com/LATEST_RELEASE', false, stream_context_create());"

Hm. I can confirm that I can still get PHP to run that line and get the expected result — tested with PHP 7.4, 8.0 and 8.1, all installed from Ondrej's PHP PPA (the 'golden standard' in terms of PHP packaging for Ubuntu) under Ubuntu 22.04.1 LTS, with OpenSSL 3.0.2 (library compiled on 15 Mar 2022).

Maybe the reason for my apparent success in getting OpenSSL working with PHP is because I'm using Ondrej's PPA? It's rather more up-to-date than the Ubuntu default (the PHP maintainers for Ubuntu are usually asleep at their desks...) and definitely most recommended, nay, even mandatory to use these days.

Note that if you use PHP with a web server (and who doesn't, these days?) Ondrej recommends installing his companion PPAs for Apache2 and/or nginx as well — they have been optimised to work with his PHP PPA. That doesn't mean that you cannot use other webservers or other sources for installing such webservers; for example, I run my own self-compiled version of nginx, because, among several other reasons, I want to accept HTTP/3 connections, and that, in turn, requires using a version of OpenSSL that supports QUIC; the official OpenSSL developers do not want to go that route, so I have to use a fork made by Microsoft and Akamai — which, in turn, forces nginx to be compiled from scratch...

Now that I'm thinking of it, maybe the reason why this works in my environment is because I neither use Ubuntu's standard PHP/nginx packages, neither OpenSSL's... sorry, I haven't tried it with a clean install using only the official repositories!

Still not working on Ubuntu 22.04. There's an option SSL_OP_IGNORE_UNEXPECTED_EOF but I can't seem to get it setup correctly.

openssl.cnf
[system_default_sect]
Options = SSL_OP_IGNORE_UNEXPECTED_EOF
CipherString = DEFAULT@SECLEVEL=2

Doesn't seem to change anything.

Huh.

I continue without any problems running it under Ubuntu 22.04 LTS and Ondrej's PPA. This time, I even tested it with php8.3, and the results are as expected — it shows exactly the same as my home Mac PowerBook.

I wonder... those of you with issues under Ubuntu 22.04... what does the following command show to you?

$ php8.3 -i | grep -i ssl
Registered Stream Socket Transports => tcp, udp, unix, udg, ssl, tls, tlsv1.0, tlsv1.1, tlsv1.2, tlsv1.3
SSL => Yes
MULTI_SSL => No
SSL Version => OpenSSL/3.0.2
libSSH Version => libssh/0.10.5/openssl/zlib
SSL Support => enabled
core SSL => supported
extended SSL => supported
openssl
OpenSSL support => enabled
OpenSSL Library Version => OpenSSL 3.0.2 15 Mar 2022
OpenSSL Header Version => OpenSSL 3.0.2 15 Mar 2022
Openssl default config => /usr/lib/ssl/openssl.cnf
openssl.cafile => no value => no value
openssl.capath => no value => no value
Native OpenSSL support => enabled

(Note: on my system, /usr/lib/ssl/openssl.cnf is symlinked to /etc/ssl/openssl.cnf; YMMV.)

Also: are you sure that the access file_get_contents() has not been blocked at the OS level, for some silly reason? Some system admins consider file_get_contents() to be a potential source of conflicts/security exploits and therefore it might be blocked at the php.ini config file...