SSL operation failed with code 1

[Rubas]

Hello VestaCP community,

Recently when I tried setting up a smtp connection to Mandrill, my mails wouldn't be sent and I was receiving an error like this:

Code: Select all

Warning: stream_socket_enable_crypto(): SSL operation failed with code 1.
OpenSSL Error messages: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

So I started debugging, and since we never had this problem with other servers with VestaCP, I figured out that it must be something in php 5.6.17, and realized that it must be a cert.pem file not existing.

I first ran the php function called openssl_get_certs_locations(); (only works in 5.6+) and found a path to the cert.pem, the path was:

Code: Select all

/usr/lib/ssl/cert.pem

But by surprise, this cert.pem did not exist in ssl, and thereby I concluded that this must be the mistake.
To fix this issue, I followed this guide: https://support.zend.com/hc/en-us/artic ... or-PHP-5-6

To fix it by a single command, you can do the following:

Code: Select all

wget http://curl.haxx.se/ca/cacert.pem -O /usr/lib/ssl/cert.pem

This issue could be classified as a securityhole.

Best regards,
- Rubas,