doujia2463 2016-07-14 16:35
浏览 48
已采纳

使用Satis和HTTPS(内部CA)时,Composer失败

I'm trying to setup our internal Satis server which should be reachable via HTTPS (certificate is signed by an internal CA). On Linux, everything works as expected once the root certificate of the CA is added to certificate store (e.g. /etc/ssl/certs/ca-certificates.crt). But on my Mac, I'm getting a "SSL operation failed with code 1" error even after adding the certificate to the OS X Keychain. Curl on the command line and using libcurl in PHP can fetch the HTTPS URL but Composer and file_get_contents (which is used by Composer) always throw the "SSL operation failed with code 1" error.

I know I can specify the "openssl.capath" in my php.ini but why does it work with Curl without specifying the path?

  • 写回答

1条回答 默认 最新

  • doutan4831 2016-07-15 12:29
    关注

    I finally figured out what's wrong:

    Curl is using SecureTransport instead of OpenSSL, so it's directly using the OS X Keychain and therefore works with certificates signed by public CAs as well as our internal CA (I've added it to the System keychain before).

    file_get_contents is using OpenSSL which uses it's own CA bundle located at /usr/local/etc/openssl/cert.pem.

    As /usr/local/etc/openssl/cert.pem only contains public CAs by default, I had to export the certificates from my Keychain (System and System Roots) to the cert.pem of OpenSSL: security find-certificate -a -p /Library/Keychains/System.keychain /System/Library/Keychains/SystemRootCertificates.keychain | sudo tee /usr/local/etc/openssl/cert.pem

    Now file_get_contents() works for both, internal as well as external certificates/CAs.

    But Composer does not look into /usr/local/etc/openssl/cert.pem, so I had to set the openssl.cafile php.ini property to the path of the cert.pem:

    [openssl] openssl.cafile = /usr/local/etc/openssl/cert.pem

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论

报告相同问题?

悬赏问题

  • ¥15 【提问】基于Invest的水源涵养
  • ¥20 微信网友居然可以通过vx号找到我绑的手机号
  • ¥15 spring后端vue前端
  • ¥15 寻一个支付宝扫码远程授权登录的软件助手app
  • ¥15 解riccati方程组
  • ¥15 display:none;样式在嵌套结构中的已设置了display样式的元素上不起作用?
  • ¥15 使用rabbitMQ 消息队列作为url源进行多线程爬取时,总有几个url没有处理的问题。
  • ¥15 Ubuntu在安装序列比对软件STAR时出现报错如何解决
  • ¥50 树莓派安卓APK系统签名
  • ¥65 汇编语言除法溢出问题