Skip to content

Instantly share code, notes, and snippets.

@rdh27785
Created May 4, 2022 02:42
Show Gist options
  • Save rdh27785/97210d439a280063bd768006450c435d to your computer and use it in GitHub Desktop.
Save rdh27785/97210d439a280063bd768006450c435d to your computer and use it in GitHub Desktop.
diff -uN /etc/ssl/openssl.cnf\~original /etc/ssl/openssl.cnf for Nextcloud with OpenSSL 3
--- /etc/ssl/openssl.cnf~original 2022-03-16 08:35:51.000000000 +0000
+++ /etc/ssl/openssl.cnf 2022-05-04 02:37:30.336530711 +0000
@@ -56,6 +56,7 @@
# List of providers to load
[provider_sect]
default = default_sect
+legacy = legacy_sect
# The fips section name should match the section name inside the
# included fipsmodule.cnf.
# fips = fips_sect
@@ -69,7 +70,9 @@
# OpenSSL may not work correctly which could lead to significant system
# problems including inability to remotely access the system.
[default_sect]
-# activate = 1
+activate = 1
+[legacy_sect]
+activate = 1
####################################################################
@rdh27785
Copy link
Author

rdh27785 commented May 4, 2022

After modifying the file, you need to restart the program that depends on OpenSSL. For example, if you are running Nextcloud with FPM on Ubuntu 22.04, you need to do systemctl restart php8.1-fpm.

@fberbert
Copy link

Thank you, it saved my life

@truongbo17
Copy link

not working,help me !!!!!!!

@cprn
Copy link

cprn commented May 31, 2022

Doesn't seem to work on Ubuntu 22.04 and OpenSSL 3.0.2 - do you have any more mentions of "legacy" in your config?

@tang9527
Copy link

tang9527 commented Jun 5, 2022

Thank you, it saved my life

@wa1kb0y
Copy link

wa1kb0y commented Jun 6, 2022

Helped for openssl_pkcs12_read function start work properly.
But php -r "echo file_get_contents('https://chromedriver.storage.googleapis.com/LATEST_RELEASE', false, stream_context_create());" still producing warning.
ubuntu 22.04, php 8.1.6

@tgedikli
Copy link

tgedikli commented Jun 6, 2022

Doesn't seem to work on Ubuntu 22.04 and OpenSSL 3.0.2 - do you have any more mentions of "legacy" in your config?

+1

@codgunt
Copy link

codgunt commented Jun 8, 2022

This change exists but is commented out in the default openssl.conf file for Fedora 36:

##default = default_sect
##legacy = legacy_sect

##[default_sect]
##activate = 1

##[legacy_sect]
##activate = 1

Uncommenting and restarting Apache / php-fpm does not prevent the PHP error, at least when using CURL. Still getting:

 OpenSSL SSL_read: error:0A000126:SSL routines::unexpected eof while reading, errno 0

@binary10ve
Copy link

Didn't work for me even after nginx restart

@LucaColombi
Copy link

same here
php -r "echo file_get_contents('https://chromedriver.storage.googleapis.com/LATEST_RELEASE', false, stream_context_create());"
give error also with this update, php restart and nginx restart

@tomtry610
Copy link

如何解决呢

src/event/ngx_event_openssl.c:902:9: error: ‘ENGINE_by_id’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
902 | engine = ENGINE_by_id((char *) p);
| ^~~~~~
In file included from src/event/ngx_event_openssl.h:22,
from src/core/ngx_core.h:89,
from src/event/ngx_event_openssl.c:9:
/usr/include/openssl/engine.h:336:31: note: declared here
336 | OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_by_id(const char *id);
| ^~~~~~~~~~~~
src/event/ngx_event_openssl.c:911:9: error: ‘ENGINE_load_private_key’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
911 | pkey = ENGINE_load_private_key(engine, (char *) last, 0, 0);
| ^~~~
In file included from src/event/ngx_event_openssl.h:22,
from src/core/ngx_core.h:89,
from src/event/ngx_event_openssl.c:9:
/usr/include/openssl/engine.h:638:11: note: declared here
638 | EVP_PKEY *ENGINE_load_private_key(ENGINE *e, const char *key_id,
| ^~~~~~~~~~~~~~~~~~~~~~~
src/event/ngx_event_openssl.c:915:13: error: ‘ENGINE_free’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
915 | ENGINE_free(engine);
| ^~~~~~~~~~~
In file included from src/event/ngx_event_openssl.h:22,
from src/core/ngx_core.h:89,
from src/event/ngx_event_openssl.c:9:
/usr/include/openssl/engine.h:493:27: note: declared here
493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e);
| ^~~~~~~~~~~
src/event/ngx_event_openssl.c:919:9: error: ‘ENGINE_free’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
919 | ENGINE_free(engine);
| ^~~~~~~~~~~
In file included from src/event/ngx_event_openssl.h:22,
from src/core/ngx_core.h:89,
from src/event/ngx_event_openssl.c:9:
/usr/include/openssl/engine.h:493:27: note: declared here
493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e);
| ^~~~~~~~~~~
src/event/ngx_event_openssl.c: In function ‘ngx_ssl_dhparam’:
src/event/ngx_event_openssl.c:1515:5: error: ‘PEM_read_bio_DHparams’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
1515 | dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
| ^~
In file included from /usr/include/openssl/ssl.h:36,
from src/event/ngx_event_openssl.h:15,
from src/core/ngx_core.h:89,
from src/event/ngx_event_openssl.c:9:
/usr/include/openssl/pem.h:469:1: note: declared here
469 | DECLARE_PEM_rw_attr(OSSL_DEPRECATEDIN_3_0, DHparams, DH)
| ^~~~~~~~~~~~~~~~~~~
src/event/ngx_event_openssl.c:1525:5: error: ‘DH_free’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
1525 | DH_free(dh);
| ^~~~~~~

@tomtry610
Copy link

如何解决呢
src/event/ngx_event_openssl.c:902:9: error: ‘ENGINE_by_id’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
902 | engine = ENGINE_by_id((char *) p);
| ^~~~~~
In file included from src/event/ngx_event_openssl.h:22,
from src/core/ngx_core.h:89,
from src/event/ngx_event_openssl.c:9:
/usr/include/openssl/engine.h:336:31: note: declared here
336 | OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_by_id(const char *id);
| ^~~~~~~~~~~~
src/event/ngx_event_openssl.c:911:9: error: ‘ENGINE_load_private_key’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
911 | pkey = ENGINE_load_private_key(engine, (char *) last, 0, 0);
| ^~~~
In file included from src/event/ngx_event_openssl.h:22,
from src/core/ngx_core.h:89,
from src/event/ngx_event_openssl.c:9:
/usr/include/openssl/engine.h:638:11: note: declared here
638 | EVP_PKEY *ENGINE_load_private_key(ENGINE *e, const char *key_id,
| ^~~~~~~~~~~~~~~~~~~~~~~
src/event/ngx_event_openssl.c:915:13: error: ‘ENGINE_free’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
915 | ENGINE_free(engine);
| ^~~~~~~~~~~
In file included from src/event/ngx_event_openssl.h:22,
from src/core/ngx_core.h:89,
from src/event/ngx_event_openssl.c:9:
/usr/include/openssl/engine.h:493:27: note: declared here
493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e);
| ^~~~~~~~~~~
src/event/ngx_event_openssl.c:919:9: error: ‘ENGINE_free’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
919 | ENGINE_free(engine);
| ^~~~~~~~~~~
In file included from src/event/ngx_event_openssl.h:22,
from src/core/ngx_core.h:89,
from src/event/ngx_event_openssl.c:9:
/usr/include/openssl/engine.h:493:27: note: declared here
493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e);
| ^~~~~~~~~~~
src/event/ngx_event_openssl.c: In function ‘ngx_ssl_dhparam’:
src/event/ngx_event_openssl.c:1515:5: error: ‘PEM_read_bio_DHparams’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
1515 | dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
| ^~
In file included from /usr/include/openssl/ssl.h:36,
from src/event/ngx_event_openssl.h:15,
from src/core/ngx_core.h:89,
from src/event/ngx_event_openssl.c:9:
/usr/include/openssl/pem.h:469:1: note: declared here
469 | DECLARE_PEM_rw_attr(OSSL_DEPRECATEDIN_3_0, DHparams, DH)
| ^~~~~~~~~~~~~~~~~~~
src/event/ngx_event_openssl.c:1525:5: error: ‘DH_free’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
1525 | DH_free(dh);
| ^~~~~~~

@Susros
Copy link

Susros commented Aug 13, 2022

This isn't working for me either. Anyone has solved it? My environment is Ubuntu 22.04, PHP 8.1.2 and Apache2

@Dougwan
Copy link

Dougwan commented Aug 31, 2022

Thanks @rdh27785, you saved my life!

@eliosh
Copy link

eliosh commented Sep 2, 2022

same here

php -r "echo file_get_contents('https://chromedriver.storage.googleapis.com/LATEST_RELEASE', false, stream_context_create());"

give error

@Susros
Copy link

Susros commented Sep 2, 2022

@eliosh , try updating your system. apt update, apt upgrade will update php minor version that fixed it for me

@gabeyww
Copy link

gabeyww commented Sep 8, 2022

This isn't working for me either. Anyone has solved it? My environment is Ubuntu 22.04, PHP 8.1.2 and Apache2

+1

@marcovisona
Copy link

Thank you so much it worked! on Ubuntu 22.04, PHP 7.4, nginx

@GwynethLlewelyn
Copy link

I'd say that it's working for me on PHP, but not on Postfix. Oh well. It was worth a try, I guess!

@davidnaviaweb
Copy link

Doesn't seem to work on Ubuntu 22.04 and OpenSSL 3.0.2 - do you have any more mentions of "legacy" in your config?

+1 here... any thoughts?

@GwynethLlewelyn
Copy link

php -r "echo file_get_contents('https://chromedriver.storage.googleapis.com/LATEST_RELEASE', false, stream_context_create());"

Hm. I can confirm that I can still get PHP to run that line and get the expected result — tested with PHP 7.4, 8.0 and 8.1, all installed from Ondrej's PHP PPA (the 'golden standard' in terms of PHP packaging for Ubuntu) under Ubuntu 22.04.1 LTS, with OpenSSL 3.0.2 (library compiled on 15 Mar 2022).

Maybe the reason for my apparent success in getting OpenSSL working with PHP is because I'm using Ondrej's PPA? It's rather more up-to-date than the Ubuntu default (the PHP maintainers for Ubuntu are usually asleep at their desks...) and definitely most recommended, nay, even mandatory to use these days.

Note that if you use PHP with a web server (and who doesn't, these days?) Ondrej recommends installing his companion PPAs for Apache2 and/or nginx as well — they have been optimised to work with his PHP PPA. That doesn't mean that you cannot use other webservers or other sources for installing such webservers; for example, I run my own self-compiled version of nginx, because, among several other reasons, I want to accept HTTP/3 connections, and that, in turn, requires using a version of OpenSSL that supports QUIC; the official OpenSSL developers do not want to go that route, so I have to use a fork made by Microsoft and Akamai — which, in turn, forces nginx to be compiled from scratch...

Now that I'm thinking of it, maybe the reason why this works in my environment is because I neither use Ubuntu's standard PHP/nginx packages, neither OpenSSL's... sorry, I haven't tried it with a clean install using only the official repositories!

@gbryant200
Copy link

Still not working on Ubuntu 22.04. There's an option SSL_OP_IGNORE_UNEXPECTED_EOF but I can't seem to get it setup correctly.

openssl.cnf
[system_default_sect]
Options = SSL_OP_IGNORE_UNEXPECTED_EOF
CipherString = DEFAULT@SECLEVEL=2

Doesn't seem to change anything.

@GwynethLlewelyn
Copy link

Huh.

I continue without any problems running it under Ubuntu 22.04 LTS and Ondrej's PPA. This time, I even tested it with php8.3, and the results are as expected — it shows exactly the same as my home Mac PowerBook.

I wonder... those of you with issues under Ubuntu 22.04... what does the following command show to you?

$ php8.3 -i | grep -i ssl
Registered Stream Socket Transports => tcp, udp, unix, udg, ssl, tls, tlsv1.0, tlsv1.1, tlsv1.2, tlsv1.3
SSL => Yes
MULTI_SSL => No
SSL Version => OpenSSL/3.0.2
libSSH Version => libssh/0.10.5/openssl/zlib
SSL Support => enabled
core SSL => supported
extended SSL => supported
openssl
OpenSSL support => enabled
OpenSSL Library Version => OpenSSL 3.0.2 15 Mar 2022
OpenSSL Header Version => OpenSSL 3.0.2 15 Mar 2022
Openssl default config => /usr/lib/ssl/openssl.cnf
openssl.cafile => no value => no value
openssl.capath => no value => no value
Native OpenSSL support => enabled

(Note: on my system, /usr/lib/ssl/openssl.cnf is symlinked to /etc/ssl/openssl.cnf; YMMV.)

Also: are you sure that the access file_get_contents() has not been blocked at the OS level, for some silly reason? Some system admins consider file_get_contents() to be a potential source of conflicts/security exploits and therefore it might be blocked at the php.ini config file...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment