Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 30 Apr 2018 10:29:40 -0400
From:      "James B. Byrne" <>
Subject:   PHP and openssl
Message-ID:  <>

Next in thread | Raw E-Mail | Index | Archive | Help
I am trying to get a Squirrelmail-1.4.23, running on FreeBSD-11.1
under Apache-2.4.33, to connect to our existing Cyrus-IMAP and SMTP
services using TLS.  Examination of the web service log files for ssh
reveals these messages:

[Mon Apr 30 09:10:22.510233 2018] [:error] [pid 75098] [client] PHP Warning:  fsockopen(): SSL operation failed
with code 1. OpenSSL Error messages:\nerror:14090086:SSL
routines:ssl3_get_server_certificate:certificate verify failed in
/usr/local/www/squirrelmail/src/configtest.php on line 406

[Mon Apr 30 09:10:22.510311 2018] [:error] [pid 75098] [client] PHP Warning:  fsockopen(): Failed to enable
crypto in /usr/local/www/squirrelmail/src/configtest.php on line 406

[Mon Apr 30 09:10:22.511594 2018] [:error] [pid 75098] [client] PHP Warning:  fsockopen(): unable to connect to
ssl:// (Unknown error) in
/usr/local/www/squirrelmail/src/configtest.php on line 406

Now, if I connect to using openssl
s_client I see this:

 openssl s_client -connect
depth=2 CN = CA_HLL_ROOT_2016, ST = Ontario, O = Harte & Lyne Limited,
OU = Networked Data Services, C = CA, DC = harte-lyne, DC = ca, L =
verify error:num=19:self signed certificate in certificate chain
Certificate chain
 0 s:/ Data
Services/O=Harte & Lyne

   i:/CN=CA_HLL_ISSUER_2016/OU=Networked Data Services/O=Harte & Lyne

 1 s:/CN=CA_HLL_ISSUER_2016/OU=Networked Data Services/O=Harte & Lyne

   i:/CN=CA_HLL_ROOT_2016/ST=Ontario/O=Harte & Lyne
Limited/OU=Networked Data

 2 s:/CN=CA_HLL_ROOT_2016/ST=Ontario/O=Harte & Lyne
Limited/OU=Networked Data

   i:/CN=CA_HLL_ROOT_2016/ST=Ontario/O=Harte & Lyne
Limited/OU=Networked Data

. . .
/CN=CA_HLL_ISSUER_2016/OU=Networked Data Services/O=Harte & Lyne
/CN=CA_HLL_ROOT_2016/ST=Ontario/O=Harte & Lyne Limited/OU=Networked
Data Services/C=CA/DC=harte-lyne/DC=ca/L=Hamilton
/CN=CA HLL ISSUER 01/OU=Networked Data Services/O=Harte & Lyne
/CN=CA HLL ROOT/OU=Networked Data Services/O=Harte & Lyne
Client Certificate Types: RSA sign, DSA sign, ECDSA sign
Requested Signature Algorithms:
Shared Requested Signature Algorithms:
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
SSL handshake has read 26264 bytes and written 445 bytes
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
. . .
    Start Time: 1525097083
    Timeout   : 300 (sec)
    Verify return code: 19 (self signed certificate in certificate chain)
220 ESMTP Postfix

At which point I can manually issue an EHLO and connect.

This indicates to me that the issue lies in one or more configuration
issues relating to Apache-2.4, PHP-5.6 and Squirrelmail.

The Squirrelmail SMTP and IMAP configurations of the service having
problems are identical to those used by our existing and fully
functioning Squirrelmail system.

The message

PHP Warning:  fsockopen(): unable to connect to
ssl:// (Unknown error) in
/usr/local/www/squirrelmail/src/configtest.php on line 406

refers to this line of code:


  405    $stream = fsockopen(
($use_smtp_tls?'ssl://':'').$smtpServerAddress, $smtpPort,

  406            $errorNumber, $errorString);

Which to me indicates that the issue is the call to fsockopen is the
real issue.  Researching this error leads to multiple reports of a
php.ini configuration issue, but always with respect to MiscoSoft

I have verified that the necessary php module is installed:

# pkg search openssl | grep php
php56-openssl-5.6.35           The openssl shared extension for php
php70-openssl-7.0.29           The openssl shared extension for php
php71-openssl-7.1.16           The openssl shared extension for php
php72-openssl-7.2.4            The openssl shared extension for php

# pkg info php56-openssl
Name           : php56-openssl
Version        : 5.6.35
Installed on   : Wed Apr 11 10:36:37 2018 EDT
. . .

Other than for Windows systems there seem to be no specific
configuration options for openssl inside /usr/local/etc/php.ini. 
Likewise, the contents of /usr/local/etc/apache24/Includes/php.conf
make no reference to openssl

Has anyone any ideas on how to solve this issue?

***          e-Mail is NOT a SECURE channel          ***
        Do NOT transmit sensitive data via e-Mail
 Do NOT open attachments nor follow links sent by e-Mail

James B. Byrne      
Harte & Lyne Limited
9 Brockley Drive              vox: +1 905 561 1241
Hamilton, Ontario             fax: +1 905 561 0757
Canada  L8E 3C3

Want to link to this message? Use this URL: <>