diff -uN /etc/ssl/openssl.cnf\~original /etc/ssl/openssl.cnf for Nextcloud with OpenSSL 3

openssl.cnf.diff

--- /etc/ssl/openssl.cnf~original	2022-03-16 08:35:51.000000000 +0000
+++ /etc/ssl/openssl.cnf	2022-05-04 02:37:30.336530711 +0000
@@ -56,6 +56,7 @@
 # List of providers to load
 [provider_sect]
 default = default_sect
+legacy = legacy_sect
 # The fips section name should match the section name inside the
 # included fipsmodule.cnf.
 # fips = fips_sect
@@ -69,7 +70,9 @@
 # OpenSSL may not work correctly which could lead to significant system
 # problems including inability to remotely access the system.
 [default_sect]
-# activate = 1
+activate = 1
+[legacy_sect]
+activate = 1
 
 
 ####################################################################

This isn't working for me either. Anyone has solved it? My environment is Ubuntu 22.04, PHP 8.1.2 and Apache2

+1

Thank you so much it worked! on Ubuntu 22.04, PHP 7.4, nginx

I'd say that it's working for me on PHP, but not on Postfix. Oh well. It was worth a try, I guess!

Doesn't seem to work on Ubuntu 22.04 and OpenSSL 3.0.2 - do you have any more mentions of "legacy" in your config?

+1 here... any thoughts?

php -r "echo file_get_contents('https://chromedriver.storage.googleapis.com/LATEST_RELEASE', false, stream_context_create());"

Hm. I can confirm that I can still get PHP to run that line and get the expected result — tested with PHP 7.4, 8.0 and 8.1, all installed from Ondrej's PHP PPA (the 'golden standard' in terms of PHP packaging for Ubuntu) under Ubuntu 22.04.1 LTS, with OpenSSL 3.0.2 (library compiled on 15 Mar 2022).

Maybe the reason for my apparent success in getting OpenSSL working with PHP is because I'm using Ondrej's PPA? It's rather more up-to-date than the Ubuntu default (the PHP maintainers for Ubuntu are usually asleep at their desks...) and definitely most recommended, nay, even mandatory to use these days.

Note that if you use PHP with a web server (and who doesn't, these days?) Ondrej recommends installing his companion PPAs for Apache2 and/or nginx as well — they have been optimised to work with his PHP PPA. That doesn't mean that you cannot use other webservers or other sources for installing such webservers; for example, I run my own self-compiled version of nginx, because, among several other reasons, I want to accept HTTP/3 connections, and that, in turn, requires using a version of OpenSSL that supports QUIC; the official OpenSSL developers do not want to go that route, so I have to use a fork made by Microsoft and Akamai — which, in turn, forces nginx to be compiled from scratch...

Now that I'm thinking of it, maybe the reason why this works in my environment is because I neither use Ubuntu's standard PHP/nginx packages, neither OpenSSL's... sorry, I haven't tried it with a clean install using only the official repositories!

Still not working on Ubuntu 22.04. There's an option SSL_OP_IGNORE_UNEXPECTED_EOF but I can't seem to get it setup correctly.

openssl.cnf
[system_default_sect]
Options = SSL_OP_IGNORE_UNEXPECTED_EOF
CipherString = DEFAULT@SECLEVEL=2

Doesn't seem to change anything.

Huh.

I continue without any problems running it under Ubuntu 22.04 LTS and Ondrej's PPA. This time, I even tested it with php8.3, and the results are as expected — it shows exactly the same as my home Mac PowerBook.

I wonder... those of you with issues under Ubuntu 22.04... what does the following command show to you?

$ php8.3 -i | grep -i ssl
Registered Stream Socket Transports => tcp, udp, unix, udg, ssl, tls, tlsv1.0, tlsv1.1, tlsv1.2, tlsv1.3
SSL => Yes
MULTI_SSL => No
SSL Version => OpenSSL/3.0.2
libSSH Version => libssh/0.10.5/openssl/zlib
SSL Support => enabled
core SSL => supported
extended SSL => supported
openssl
OpenSSL support => enabled
OpenSSL Library Version => OpenSSL 3.0.2 15 Mar 2022
OpenSSL Header Version => OpenSSL 3.0.2 15 Mar 2022
Openssl default config => /usr/lib/ssl/openssl.cnf
openssl.cafile => no value => no value
openssl.capath => no value => no value
Native OpenSSL support => enabled

(Note: on my system, /usr/lib/ssl/openssl.cnf is symlinked to /etc/ssl/openssl.cnf; YMMV.)

Also: are you sure that the access file_get_contents() has not been blocked at the OS level, for some silly reason? Some system admins consider file_get_contents() to be a potential source of conflicts/security exploits and therefore it might be blocked at the php.ini config file...