php - PHP 5.6 上的 Codeigniter 2x 电子邮件类 SMTP SSL 验证错误

Question

我不知道你们中有多少人在 PHP 5.6 上使用 Codeigniter 2x，但这个最新的 PHP 版本带来了 Codeigniter 尚未适应的变化。其中一项更改是关于 OpenSSL 的:

All encrypted client streams now enable peer verification by default. By default, this will use OpenSSL's default CA bundle to verify the peer certificate. In most cases, no changes will need to be made to communicate with servers with valid SSL certificates, as distributors generally configure OpenSSL to use known good CA bundles. - OpenSSL changes in PHP 5.6.x (PHP Manual)

---

It appears that in PHP 5.6.0 (at least the version in Debian jessie, with openssl 1.0.1h-3), this function is now validating SSL certificates (in a variety of ways). First, it appears to fail for untrusted certificates (i.e. no matching CA trusted locally), and secondly, it appears to fail for mismatched hostnames in the request and certificate.

---

"PHP 5.6 now verifies SSL certificates, the "fsockopen" function fails in the "ConnectToHost" method due to mismatched certificate CN (expects host name, but IP is given instead)." - Klemen (PHP 5.6 compatibility)

问题是此更改会导调用子邮件类 SMTP 协议(protocol)出错:

fsockopen(): SSL operation failed with code 1. OpenSSL Error messages: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

我正在使用 Windows 的 IIS 7 本地服务器，当我将 PHP 的版本切换到 5.3 时，电子邮件已成功发送。现在，当我将其切换回 5.6 时，会进行 SSL 验证。话虽如此，这确实是 PHP 最新版本 5.6 的问题。

这是我用来通过 SMTP 发送电子邮件的代码:

    $config = array(
      'protocol' => 'smtp',
      'smtp_host' => 'ssl://smtp.googlemail.com',
      'smtp_port' => 465,
      'smtp_user' => 'xxxx@gmail.com', // change it to yours
      'smtp_pass' => 'xxxx', // change it to yours
      'mailtype' => 'html',
      'charset' => 'iso-8859-1',
      'wordwrap' => TRUE,
    );
    $message = 'When they give you the eys!!!!';
    $this->load->library('email', $config);
    $this->email->set_newline("\r\n");
    $this->email->from('xxxx@xxxx.com','Insert Name'); // change it to yours
    $this->email->to('xxxxx@xxxxxx.com');// change it to yours
    $this->email->subject('Bye, bye, pretty baby!');
    $this->email->message($message);
    if($this->email->send())
    {
     echo 'Email sent.';
    }
    else
    {
     show_error($this->email->print_debugger());
    }

这是电子邮件库使用 SMTP 发送电子邮件的方法:

    protected function _smtp_connect()
{
    $ssl = NULL;
    if ($this->smtp_crypto == 'ssl')
        $ssl = 'ssl://';
    $this->_smtp_connect = fsockopen($ssl.$this->smtp_host,
                                    $this->smtp_port,
                                    $errno,
                                    $errstr,
                                    $this->smtp_timeout);
    if ( ! is_resource($this->_smtp_connect))
    {
        $this->_set_error_message('lang:email_smtp_error', $errno." ".$errstr);
        return FALSE;
    }
    $this->_set_error_message($this->_get_smtp_data());
    if ($this->smtp_crypto == 'tls')
    {
        $this->_send_command('hello');
        $this->_send_command('starttls');
        stream_socket_enable_crypto($this->_smtp_connect, TRUE, STREAM_CRYPTO_METHOD_TLS_CLIENT);
    }
    return $this->_send_command('hello');
}

你知道我怎样才能让它在 5.6 上运行吗？谢谢!

Answer 1

首先，你的邮箱配置没问题!别担心这个...
当您更新到 PHP 5.6+ 时，必须设置“CA Root”，否则 OpenSSL 证书验证无法正常工作。

第一步:安装 CA_Root(在我的例子中，在 FreeBSD 10 上，通过 Ports )
/usr/ports/security/ca_root_nss

安装后，Pem 证书 将位于:
/usr/local/etc/ssl/cert.pem

---

第二步:添加到 php.ini openssl.cafile

openssl.cafile =/usr/local/etc/ssl/cert.pem

重新启动 HTTP 服务器，并使用 phpinfo() 进行验证

More details about this, my Blog on PT-BR language

PS:有时...不要忘记授权您的设备在以下位置访问 Gmail:Settings/Other Config Account.../Devices