Composer --> 错误：14090086：SSL 例程：SSL3_GET_SERVER_CERTIFICATE：证书验证失败

Question

我可以连接到 SSL 站点，通过 HTTPS 通过命令行安装 composer。检查了 OPENSSL 版本 SSL Version => OpenSSL/1.0.1j 。那么问题出在哪里？想法？

这是原始输出。

[kunaaljain@localhost php]$ /opt/lampp/bin/php-5.6.3 composer.phar diagChecking composer.json: FAIL
the property name is required
the property description is required
No license specified, it is recommended to do so. For closed-source software you may use "proprietary" as license.
Checking platform settings: OK
Checking git settings: OK
Checking http connectivity: FAIL
[Composer\Downloader\TransportException] The "https://packagist.org/packages.json" file could not be downloaded: SSL operation failed with code 1. OpenSSL Error messages:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
failed to open stream: Cannot connect to HTTPS server through proxy
Checking HTTP proxy: FAIL
[Composer\Downloader\TransportException] The "https://packagist.org/packages.json" file could not be downloaded: SSL operation failed with code 1. OpenSSL Error messages:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
failed to open stream: Cannot connect to HTTPS server through proxy

Answer 1

我在本地 vagrant 环境中尝试运行 composer 时遇到了同样的问题。发现问题是系统时钟不同步造成的。

通过运行修复

  vagrant ssh
  sudo apt install ntpdate
  sudo ntpdate ntp.ubuntu.com
  sudo timedatectl set-ntp on
  sudo service ntp stop
  sudo ntpd -gq
  sudo service ntp start

Answer 2

在我更新到 OSX El Capitan 并在我的开发环境中同时更新其他东西之后，我在我的 Mac 上遇到了同样的情况。

我花了半天时间调查，得出的结论是，原因是在 openssl 有过时的证书。解决方案是通过 bash 脚本从 Apple 的钥匙串中提取证书：

    cert_file="$( openssl version -d | awk -F'"' '{print $2}' )/cert.pem"
    mkdir -p "${cert_file%/*}"
    security find-certificate -a -p /Library/Keychains/System.keychain > "$cert_file"
    security find-certificate -a -p /System/Library/Keychains/SystemRootCertificates.keychain >> "$cert_file"

如果之前没有手动弄乱 openssl 的配置，这在大多数情况下应该会有所帮助。需要简单更新证书。

Answer 3

这是 php > 5.6 的 OpenSSL 问题。 Rob Allen 在这里使用自制软件进行了修复： http://akrabat.com/ssl-certificate-verification-on-php-5-6/

在 github 上还有一个针对 Composer 的官方 issue： https://github.com/composer/composer/issues/2798#issuecomment-68200214

编辑链接证书文件的 php.ini 应该可以修复它：

curl.cainfo=/full/path/to/ssl/certs/ca-bundle.crt
openssl.cafile=/full/path/to/ssl/certs/ca-bundle.crt

这个问题告诉你如何找到正确的路径： Composer update fails while updating from packagist