PHPMailer - SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

Question

Have encountered an issue where email should be sent from an mail server which has self signed certificate, the error which I get is :

PHP Warning:  stream_socket_enable_crypto(): SSL operation failed with code 1. OpenSSL Error messages:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed in class.smtp.php on line 327.

Has anyone encountered anything similar?

EDIT:

I have also tried to set the stream_context params (params: SSL context options):

$options['ssl']['verify_peer'] = false;
$options['ssl']['verify_peer_name'] = false;
$options['ssl']['allow_self_signed'] = true;

No luck, it still fails with the same error as pointed above.

Thanks.

It may be that the server doesn't support SSLv3 (in the wake of the POODLE hack). I'm not sure how you can configure your client to not try SSL, but use TLS from the start. — Synchro, Nov 09 '14 at 13:17

score 90 · Accepted Answer · edited Sep 05 '18 at 07:57

90

PHP 5.6 introduces SSL certificate verification, so if your config is broken, it will fail with this error. You should fix your SSL, but you can revert to the old behaviour by setting the SMTPOptions property to not verify certificates:

$mail->SMTPOptions = array(
    'ssl' => array(
        'verify_peer' => false,
        'verify_peer_name' => false,
        'allow_self_signed' => true
    )
);

Editing the library defeats the entire point of libraries - and if you do as Kaf's answer suggests, your code will break when you upgrade. Really, don't do that.

Editor's note: disabling SSL verification has security implications. Without verification of the authenticity of SSL/HTTPS connections, a malicious attacker can impersonate a trusted endpoint (such as GitHub or some other remote Git host), and you'll be vulnerable to a Man-in-the-Middle Attack. Be sure you fully understand the security issues before using this as a solution.

edited Sep 05 '18 at 07:57

PiTheNumber

22,828
17
107
180

answered Feb 27 '15 at 07:47

Synchro

35,538
15
81
104

where do i edit this file? im using linux, i dont know where to locate this – Jun 01 '15 at 01:49
This would be in your own script, wherever you're calling PHPMailer from. – Synchro Jun 11 '15 at 16:25
1

Thanks for your answer, but how can one fix the issue , instead of ignoring it ? i have read troubleshooting guide but it says "The correct fix for this is to replace the invalid, misconfigured or self-signed certificate with a good one. ", i am new in all this, where can i i get more detailed information about solving the issue , instead of ignoring it, any links or articles would be great. I got the part which says i need to install SSL cert, but where and how ? – Sep 12 '15 at 05:56
1

It's the same as an SSL cert for a web server - it needs to match the domain, be signed by a trusted CA (i.e. not self-signed), and should have an SHA2 hash and use a 2048-bit key. How you install it depends on your specific server - and it will tell you in its docs. – Synchro Sep 12 '15 at 07:32
Thank you @Synchro. I also needed to update the PHPMailer package. – trogne Mar 21 '16 at 20:13

score 19 · Answer 2 · edited Sep 05 '18 at 07:57

19

I have the same problem. So i changed the file class.smtp.php in line 238:

public function connect($host, $port = null, $timeout = 30, $options = array()) {
       if (count($options) == 0) {
           $options['ssl'] = array('verify_peer' => false, 'verify_peer_name' => false, 'allow_self_signed' => true);
       }

now it works fine!

Editor's note: disabling SSL verification has security implications. Without verification of the authenticity of SSL/HTTPS connections, a malicious attacker can impersonate a trusted endpoint (such as GitHub or some other remote Git host), and you'll be vulnerable to a Man-in-the-Middle Attack. Be sure you fully understand the security issues before using this as a solution.

edited Sep 05 '18 at 07:57

PiTheNumber

22,828
17
107
180

answered Jan 13 '15 at 14:14

Kaf

263
3
4

8

There's a reason the `connect` function takes an `options` array parameter - it allows you to set that without having to alter the library. – Synchro Feb 27 '15 at 07:07
I think this is going to make the website unsecure right? – Jun 01 '15 at 01:13
It doesn't make the whole site insecure, but means it's open to spoofing by a fake mail server, and messages received for it are more likey to be classed as spam. – Synchro Jun 01 '15 at 07:31
okay thanks, i found another way to do this. this method is not secure, your disabling your security. – Jun 12 '15 at 05:24
@MarlonBuendia, How did you do it? – user2335065 Jul 04 '15 at 10:08
@user2335065 first, get yourself a name. 2nd, im using laravel, i just changed the `app/config/mail.php` file. changing `'driver' => 'smtp',` to `'driver' => 'mail',` – Jul 04 '15 at 16:22
3

Switching to the mail transport doesn't solve the problem, it just moves it somewhere else. Please don't upvote this answer as it suggests a fundamentally wrong way of implementing the solution. – Synchro Jul 16 '15 at 21:53

score 4 · Answer 3 · answered Mar 10 '17 at 14:54

I had the same problem. It turned out that my Postfix config was missing the intermediates and root certificates setting:

smtpd_tls_CAfile=/etc/ssl/certs/intermediate-root-bundle.crt

Even though this Postfix config has worked for years with Outlook and Thunderbird, PHP was more picky and failed the SSL check.

So even though you might be tempted to hack PHPMailer, please don't, and fix the underlying problem.

score 0 · Answer 4 · edited Sep 05 '18 at 07:59

Just wanted to put my 2 cents in since I've been looking for a fix for days until I tried Kaf's solution and it worked!! Thanks @Kaf

Anyways... For me, PHPMailer was working fine until I decided to upgrade PHP to PHP5.6

Changes were made to open ssl in PHP 5.6. Here is the official docs:

http://php.net/manual/en/migration56.openssl.php

From the docs it says to set verify_peer and verify_peer_name to false

So just follow Kaf's answer and see if that works for you.

Editor's note: The doc also says this is not recommended! Disabling SSL verification has security implications. Without verification of the authenticity of SSL/HTTPS connections, a malicious attacker can impersonate a trusted endpoint (such as GitHub or some other remote Git host), and you'll be vulnerable to a Man-in-the-Middle Attack. Be sure you fully understand the security issues before using this as a solution.

No, don't follow Kaf's answer - follow mine which achieves the same thing without breaking your ability to upgrade PHPMailer. — Synchro, Sep 12 '15 at 07:30

PHPMailer - SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

4 Answers4

Linked

Related