NS8 Webserver: problems with CA verification

Support
1

NethServer Version: NS8
Module: Webserver

Hi all,

I’m getting this error while I’m trying to send emails or get contents from other external urls in ssl or https.

2026-01-09 00:02:04 Connection failed. Error #2: stream_socket_client(): SSL operation failed with code 1. OpenSSL Error messages:error:16000069:STORE routines::unregistered schemeerror:80000002:system library::No such file or directoryerror:16000069:STORE routines::unregistered schemeerror:80000002:system library::No such file or directoryerror:16000069:STORE routines::unregistered schemeerror:80000002:system library::No such file or directoryerror:0A000086:SSL routines::certificate verify failed [/var/www/html/9001/wp-includes/PHPMailer/SMTP.php line 422]

How can I solve this? The system give me this link: PHP: OpenSSL changes in PHP 5.6.x - Manual

Thank you in advance

2

Could it be a regression from the last webserver update? Does it work with the previous version?

Does the site have a valid certificate?

PHP 5.6 is quite old.
Could you please explain what exactly you are using here? is it a WP site/plugin?
So I can try to reproduce the issue.

Maybe it helps to change the mail configuration to use the domain name instead of the IP?

1 Like
3

Hi @mrmarkuz

Also with 1.3.0 doesn’t work.

Yes, both: the site on webserver and the mail server I’m trying to reach.

I’m using WP Mail SMTP and test the mail send, but you can reproduce also with a simple php script with file_get_contents function (after enabling allow fopen). You can try to reach any https site and you get this error.

It’s already with the name.

1 Like
4

with ns8-lamp I wrote a script to test to send email, do not know if it can help for test or to try to reproduce

1 Like
5

If you try to run this script:

<?php

echo file_get_contents("https://download.q-i.it/docs/miniwre/latest/en_version.txt");

It should return a version number, but at the moment it return the above error.

6

tls1.3 is the last tls encryption :-?

1 Like
7

It’s hosted on other ns8 webserver, but the same problem with ns8 mail module

8

I think it’s about a wrong openssl config.

Here is an insecure workaround:

<?php
$options=array(
    "ssl"=>array(
        "verify_peer"=>false,
        "verify_peer_name"=>false
    ),
);
echo file_get_contents("https://download.q-i.it/docs/miniwre/latest/en_version.txt", false, stream_context_create($options));
?>

The better method would be to configure the right ca cert but I didn’t find it yet.

EDIT:

Maybe related:

1 Like
9

I’ve found this solution, but with WordPress It doesn’t work:

stream_context_set_default([
    'ssl' => [
        'cafile' => '/var/www/html/9004/cacert.pem',
        'verify_peer' => true,
    ]
]);

$data = file_get_contents("https://your-url.com");

But I think we need to fix this via .ini file.

10

hum, we use a dockerfile to build our container since we have moved from bitnami, I bet we miss to install the deb that is responsible of the key and known certification authority in debian, need to check

1 Like
11

root@webserver:/var/www/html# php toto.php
Ver. 2.07root@webserver:/var/www/html#

2 Likes
12

podman exec -ti php8.4-fpm bash
apt update
apt install ca-certificates
root@webserver:/var/www/html# php toto.php
Ver. 2.07root@webserver:/var/www/html#

2 Likes
13

it will disapear after any container reboot for now, can you test @federico.ballarini

2 Likes
14

I can confirm that the php script is working after installing ca-certificates in the php container.

2 Likes
15

Yes! I confirm that also mail send works now!

Thanks a lot @stephdl and @mrmarkuz! You are special!

2 Likes
16

coming soon

2 Likes