# Broken openssl tests on Travis - Thread: https://externals.io/message/103535 - Original archive: https://news-web.php.net/php.internals/103535 - Started by Stanislav Malyshev on 2018-12-02T06:16:48+00:00 - Messages: 6 - Reply by email to internals@lists.php.net - More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt --- ## #103535 — Stanislav Malyshev — 2018-12-02T06:16:48+00:00 URL: https://externals.io/message/103535#103535 Hi! I am seeing tons of broken openssl tests on Travis CI. Example: https://travis-ci.org/php/php-src/jobs/462367522 All errors seem to be the same: 001+ Warning: `stream_socket_client()`: SSL operation failed with code 1. OpenSSL Error messages: 002+ error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed in /home/travis/build/php/php-src/ext/openssl/tests/ServerClientTestCase.inc(96) : eval()'d code on line 10 Anybody knows anything about this? -- Stas Malyshev smalyshev@gmail.com --- ## #103536 — Alexander Kurilo via internals — 2018-12-02T08:35:16+00:00 URL: https://externals.io/message/103535#103536 · In reply to: #103535 > Hi! > > I am seeing tons of broken openssl tests on Travis CI. Example: > https://travis-ci.org/php/php-src/jobs/462367522 > > All errors seem to be the same: > 001+ Warning: `stream_socket_client()`: SSL operation failed with code 1. > OpenSSL Error messages: > 002+ error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate > verify failed in > /home/travis/build/php/php-src/ext/openssl/tests/ServerClientTestCase.inc(96) > : eval()'d code on line 10 > > Anybody knows anything about this? Certificated that had been used for openssl tests, expired yesterday. There are 2 ways to proceed, as I see it: * generate new ones ASAP to get rid of false alarms; * check if there's anything to be done to avoid this in the future. To address the latter, certificates can be generated for each test run to make sure their expiration dates are never in the past but I'm not sure openssl binary has been a requirement for running tests, so maybe we're better off just generating another certificate for an upcoming decade or two. --- ## #103537 — Jakub Zelenka — 2018-12-02T10:36:14+00:00 URL: https://externals.io/message/103535#103537 · In reply to: #103535 > Hi! > > I am seeing tons of broken openssl tests on Travis CI. Example: > https://travis-ci.org/php/php-src/jobs/462367522 > > All errors seem to be the same: > 001+ Warning: `stream_socket_client()`: SSL operation failed with code 1. > OpenSSL Error messages: > 002+ error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate > verify failed in > > /home/travis/build/php/php-src/ext/openssl/tests/ServerClientTestCase.inc(96) > I'll try to find some time to sort it out today. --- ## #103652 — Alexander Kurilo via internals — 2018-12-30T20:23:02+00:00 URL: https://externals.io/message/103535#103652 · In reply to: #103535 > Hi! > > I am seeing tons of broken openssl tests on Travis CI. Example: > https://travis-ci.org/php/php-src/jobs/462367522 > > All errors seem to be the same: > 001+ Warning: `stream_socket_client()`: SSL operation failed with code 1. > OpenSSL Error messages: > 002+ error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate > verify failed in > /home/travis/build/php/php-src/ext/openssl/tests/ServerClientTestCase.inc(96) > : eval()'d code on line 10 > > Anybody knows anything about this? > Ladies and gentlemen, The day after tomorrow this is going to happen again. There are 2 ways out: * This PR https://github.com/php/php-src/pull/3698 aims to solve the root cause: it modifies tests in order to make them generate certificates on the fly and always be sure that their expiration date is in the future (and also unties lots of tests from single certificate) * If the former doesn't work or not going to be merged (tomorrow or ever), I can prepare another PR like this https://github.com/php/php-src/pull/3693 with the same certificate extended for a decade rather than a month (well, I thought a month would be sufficient to come to a decision but I was wrong). Let me know if I can help. Cheers, Alex. --- ## #103653 — Stanislav Malyshev — 2018-12-30T20:29:30+00:00 URL: https://externals.io/message/103535#103653 · In reply to: #103652 Hi! > There are 2 ways out: > * This PR https://github.com/php/php-src/pull/3698 aims to solve the > root cause: it modifies tests in order to make them generate > certificates on the fly and always be sure that their expiration date is > in the future (and also unties lots of tests from single certificate) This one looks like a bit large, probably reviewing it is going to take time, especially given as we have holiday season now when people are offline a lot. So I'd suggest to make a patch with a cert extended for another 3-4 months and continue to work on this patch to fix it once and for all. -- Stas Malyshev smalyshev@gmail.com --- ## #103654 — Alexander Kurilo via internals — 2018-12-30T21:05:27+00:00 URL: https://externals.io/message/103535#103654 · In reply to: #103653 > Hi! > > > […] > > This one looks like a bit large, probably reviewing it is going to take > time, especially given as we have holiday season now when people are > offline a lot. So I'd suggest to make a patch with a cert extended for > another 3-4 months and continue to work on this patch to fix it once and > for all. > That's reasonable. I'll create a PR with extended certs in 12 hours or so. Thanks, Alex.