SSL Verify Failed error while insatlling Composer on Windows 7 with proxy

Question

My error is whenever I try to install Composer using both the GUI and command line I get the same error with SSL verification failing and thus can't connect to HTTPs through my proxy. I am on a Windows 7 machine running XAMPP behind a proxy.

To start I have done my research on this error and have tried all of the solutions on other posts, and I am wondering what I missed.

• This one seems to be the same problem as me but no answers. https://stackoverflow.com/questions/52457358/ssl-routinestls-process-server-certificatecertificate-verify-failed-failed-to
• This one looks like it might work but I am on a Windows 7 machine and don't have the option to purge and reinstall my certificates https://stackoverflow.com/questions/53351117/php-composer-https-error-1416f086-certificate-verifying-failed
• This isn't a virtual machine, it is on the native OS so I don't think there is any time synchronization that I need to do. https://stackoverflow.com/questions/53154837/ssl-error-messages-error1416f086ssl-routinestls-process-server-certificatec

The things that I have tried:

• Currently using XAMPP for apache, I downloaded and installed latest versions as well as a few previous versions
• I re-downloaded the curl-ca-bundle.crt and updated my \xampp\apache\bin\curl-ca-bundle.crt to reflect the latest version (~roughly 20kb difference between the one that came with XAMPP and the one I downloaded).
• I manually downloaded the certificate for getcomposer.org and appended it to the end of my curl-ca-bundle.crt. (Yes I am sure that this is the file that PHP/Composer is using to install)
• When I try to install this through command line I get an error saying no such host is known. I figured out that this issue is due to HTTP/HTTPS_PROXY urls not being set. I turned them on and then I get the same error as through the GUI (found below)
• I then when through Composer's site and downloaded the .exe to install, in the installer I have the option to specify proxy (which I did) to get rid of the no sush host, after I specified the proxy I now have the exact same error as the command line.
• Disabling the SSL/TLS for composer. But it still fails when trying to contact any website with https.

GUI:

The Composer installer script was not successful [exit code 1].

OpenSSL failed with a 'certificate verify failed' error. This indicates a problem with the Certificate Authority file(s) on your system, which may be out of date.

Certificate location [from openssl.cafile ini setting]: \xampp\apache\bin\curl-ca-bundle.crt

The php.ini used by your command-line PHP is: C:\xampp\php\php.ini

Script Output: The "https://getcomposer.org/versions" file could not be downloaded: SSL operation failed with code 1. OpenSSL Error messages: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed failed to open stream: Cannot connect to HTTPS server through proxy

CMD Line:

C:\Users\S0077500\Desktop\Laravel\Attempt 7>php composer.phar diagnose
You are running Composer with SSL/TLS protection disabled.
Checking platform settings: OK
Checking git settings: OK
Checking http connectivity to packagist: OK
Checking https connectivity to packagist: WARNING
[Composer\Downloader\TransportException] The "https://repo.packagist.org/package
s.json" file could not be downloaded: SSL operation failed with code 1. OpenSSL
Error messages:
error:1416F086:SSL routines:tls_process_server_certificate:certificate verify fa
iled
failed to open stream: Cannot connect to HTTPS server through proxy
Composer is configured to disable SSL/TLS protection. This will leave remote HTT
PS requests vulnerable to Man-In-The-Middle attacks.
Checking HTTP proxy: FAIL
[Composer\Downloader\TransportException] The "https://repo.packagist.org/package
s.json" file could not be downloaded: SSL operation failed with code 1. OpenSSL
Error messages:
error:1416F086:SSL routines:tls_process_server_certificate:certificate verify fa
iled
failed to open stream: Cannot connect to HTTPS server through proxy
Checking HTTP proxy support for request_fulluri: OK
Checking HTTPS proxy support for request_fulluri: Unable to assess the situation
, maybe github is down (The "https://api.github.com/repos/Seldaek/jsonlint/zipba
ll/1.0.0" file could not be downloaded: SSL operation failed with code 1. OpenSS
L Error messages:
error:1416F086:SSL routines:tls_process_server_certificate:certificate verify fa
iled
failed to open stream: Cannot connect to HTTPS server through proxy)
Checking github.com rate limit: FAIL
[Composer\Downloader\TransportException] The "https://api.github.com/rate_limit"
 file could not be downloaded: SSL operation failed with code 1. OpenSSL Error m
essages:
error:1416F086:SSL routines:tls_process_server_certificate:certificate verify fa
iled
failed to open stream: Cannot connect to HTTPS server through proxy
Checking disk free space: OK
Checking pubkeys: FAIL
Missing pubkey for tags verification
Missing pubkey for dev verification
Run composer self-update --update-keys to set them up
Checking composer version:

  [Composer\Downloader\TransportException]
  The "https://getcomposer.org/versions" file could not be downloaded: SSL op
  eration failed with code 1. OpenSSL Error messages:
  error:1416F086:SSL routines:tls_process_server_certificate:certificate veri
  fy failed
  failed to open stream: Cannot connect to HTTPS server through proxy


diagnose


C:\Users\S0077500\Desktop\Laravel\Attempt 7>

Answer 1

I have Windows 10 with xampp 3.0.12 (php5.3). I was not able to install composer. I tried below steps it worked for me.

1. Download installer script from https://getcomposer.org/installer.
2. Save it in a file called as composer-setup.php.
3. Open composer-setup.php in your favorite editor.
4. Replace all HTTPS to HTTP and save file.

5. Execute below 3 steps in command prompt:

   php -r "if (hash_file('sha384', 'composer-setup.php') === 'a5c698ffe4b8e849a443b120cd5ba38043260d5c4023dbf93e1558871f1f07f58274fc6f4c93bcfd858c6bd0775cd8d1') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
   
   php composer-setup.php
   
   php -r "unlink('composer-setup.php');"
   

6. Voila! Successfully installed composer, you can run: php composer.phar.

Thanks

Answer 2

I had the same error. This is how I solved the problem. I followed the instructions in https://getcomposer.org/download/, paragraph below Command-line installation

```
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
php -r "if (hash_file('sha384', 'composer-setup.php') === '55ce33d7678c5a611085589f1f3ddf8b3c52d662cd01d4ba75c0ee0459970c2200a51f492d557530c71c15d8dba01eae') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
php composer-setup.php
php -r "unlink('composer-setup.php');"
```

I replaced line php composer-setup.php by php composer-setup.php --disable-tls

No need to edit the php script.

I got the idea from reviewing the code in composer-setup.php where I found the option. I should have ran php composer-setup.php --help to find the same answer faster and without reading code.