Warning: stream_socket_client(): SSL: Handshake timed out

[JerryUrena]

Warning: stream_socket_client(): SSL: Handshake timed out

Can anybody verify this issue. I have tried everything in php.ini and still wont work.

here is another issue related to that

Warning: stream_socket_enable_crypto(): SSL: Success

it seems that it is not loading the configuration or the cacert.pem specified in php.ini

[tianon]

I wasn't able to reproduce an issue using the following:

<?php
$fp = stream_socket_client('ssl://google.com:443', $errno, $errstr, 30);
if (!$fp) {
	echo "$errstr ($errno)\n";
} else {
	echo "Success!\n";
	fclose($fp);
}

I'd suggest trying a dedicated support forum, such as the Docker Community Forums, the Docker Community Slack, or Stack Overflow or even something PHP-specific for more help figuring out what's wrong in your application/configuration (and you'll probably want to share more details and/or a simple reproducer wherever you end up).

[JerryUrena]

The issue can be reproduced after doing this

`<?php
$fp = stream_socket_client('smtp.office365.com:587', $errno, $errstr, 30);
if (!$fp)
{
echo "$errstr ($errno)\n";
} else
{

//issue will be reproduced here
stream_socket_enable_crypto($fp, true, STREAM_CRYPTO_METHOD_TLSv1_2_SERVER);

echo "Success!\n";
fclose($fp);

}
`

Please double-check this issue. Thank you.

[tianon]

I don't get any handshake timeouts -- just error:1408F10B:SSL routines:ssl3_get_record:wrong version number

Edit: I get the same error if I swap from stream_socket_client('smtp.office365.com:587', ... to stream_socket_client('tls://smtp.office365.com:587', ... too.

[JerryUrena]

The errors are related. You will get different errors but all related to the same issue.

possible errors I have seen.
1- Wrong version number
2- Handshake timeout
3- SSL success (this is an error because it should be a boolean)

I have tried multiple things to fix it without success
1- modifying the php.ini and adding the lines extension=openssl and allow_url_fopen = on
2- I have also added a general cacert from curls and specified in the php.ini as well openssl.cafile= "/etc/ssl/certs/cacert.pem"

nothing seems to work.

[tianon]

I get the same error using openssl s_client directly, so perhaps this is something specific to smtp.office365.com?

root@2b254be70373:/# openssl s_client -connect smtp.office365.com:587
CONNECTED(00000003)
139931482182784:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../ssl/record/ssl3_record.c:332:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 310 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

Edit: a connection to google:443 for comparison:

root@2b254be70373:/# openssl s_client -connect google.com:443
CONNECTED(00000003)
depth=2 C = US, O = Google Trust Services LLC, CN = GTS Root R1
verify return:1
depth=1 C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
verify return:1
depth=0 CN = *.google.com
verify return:1
---
Certificate chain
...

[JerryUrena]

I am sure the error has to do with PHP and the OpenSSL extension not being loaded correctly. If you run the command you are able to connect if you add the correct cacert.pem file but you will not be able to use the PHP function stream_socket_enable_crypto. I am just not sure what to search for any more on google since I have tried everything in the last 5 days.

edit:

Seems there is also a reported bug in the PHP website. here is the link for reference.
https://bugs.php.net/bug.php?id=11058

edit:

I have also used the command directly
openssl s_client -starttls smtp -connect smtp.office365.com:587

[JerryUrena]

This does not mean you are connected. This is the information sent by the server for a handshake.

if you scroll down and verify the response, you will see two different errors and these are related to the php issue.
1- No client certificate CA names sent
2- Unable to get the local issuer certificate

@tianon Please verify this information with your connection above.

[yosifkit]

I don't see the same problem from within the php:8.1 container:

$ docker run -it --rm php:8.1 bash
Unable to find image 'php:8.1' locally
8.1: Pulling from library/php
e5ae68f74026: Already exists 
99c3c1c4d556: Pull complete 
2c23b6beb07a: Pull complete 
9874148cff9a: Pull complete 
f46ad8faa98a: Pull complete 
0e2ccbe4df72: Pull complete 
a172b6cbd216: Pull complete 
686099bd418a: Pull complete 
59311c265080: Pull complete 
Digest: sha256:b2afd03bcad73aa0a207b0be83310fb2cb35b7a47aceb89e82437b1d19bf81c5
Status: Downloaded newer image for php:8.1
root@9938d082e898:/# openssl s_client -starttls smtp -connect smtp.office365.com:587
CONNECTED(00000003)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, CN = DigiCert Cloud Services CA-1
verify return:1
depth=0 C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = outlook.com
verify return:1
---
Certificate chain
 0 s:C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = outlook.com
   i:C = US, O = DigiCert Inc, CN = DigiCert Cloud Services CA-1
 1 s:C = US, O = DigiCert Inc, CN = DigiCert Cloud Services CA-1
   i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIIpzCCB4+gAwIBAgIQDOZ8kF3eg7IOd2BqY2q5ZzANBgkqhkiG9w0BAQsFADBL
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMSUwIwYDVQQDExxE
aWdpQ2VydCBDbG91ZCBTZXJ2aWNlcyBDQS0xMB4XDTIxMTAyNDAwMDAwMFoXDTIy
MTAyMzIzNTk1OVowajELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24x
EDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlv
bjEUMBIGA1UEAxMLb3V0bG9vay5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQCdRIi9V96kDXcQ4N4pCB5fVMyI1vpZPJiXGYI/XueJpHA6bCvFUN+/
jrgWihKkf01oE0xAfnXcija0oFQXD+dnkPR5Wc6ri1ICEvKZ90+EX0KfyTM4GKEP
p2hplADRP/jQ2qGc4nHmKF6Zp6lIR/6oX/tq+IR68eboQDak5VchAPsWKyOgHQKv
CicwhDt4dPNEipA7Wv2om2f0B5mToknYw6xSzpwp7F3sPIWdoNMNkscEeTH9Jynq
jZjG2OXLhzdwPEIEkLVvNbyymlbNBVp2Qj3scR7f+Ek4xZnc9Y60bWrBz0wb2aIF
xZyiJcmy5kcHzBILbXn9thfyW9vCYSOFAgMBAAGjggVmMIIFYjAfBgNVHSMEGDAW
gBTdUdCiMXOpc66PtAF+XYxXy5/w9zAdBgNVHQ4EFgQUwQgt3DabsMeLPoFZkxiq
JMLWvNYwggIQBgNVHREEggIHMIICA4IWKi5jbG8uZm9vdHByaW50ZG5zLmNvbYIN
Ki5ob3RtYWlsLmNvbYIWKi5pbnRlcm5hbC5vdXRsb29rLmNvbYIKKi5saXZlLmNv
bYIWKi5ucmIuZm9vdHByaW50ZG5zLmNvbYIMKi5vZmZpY2UuY29tgg8qLm9mZmlj
ZTM2NS5jb22CDSoub3V0bG9vay5jb22CFyoub3V0bG9vay5vZmZpY2UzNjUuY29t
ghthdHRhY2htZW50Lm91dGxvb2subGl2ZS5uZXSCHWF0dGFjaG1lbnQub3V0bG9v
ay5vZmZpY2UubmV0giBhdHRhY2htZW50Lm91dGxvb2sub2ZmaWNlcHBlLm5ldIIW
YXR0YWNobWVudHMub2ZmaWNlLm5ldIIaYXR0YWNobWVudHMtc2RmLm9mZmljZS5u
ZXSCHWNjcy5sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tgiFjY3Mtc2RmLmxvZ2lu
Lm1pY3Jvc29mdG9ubGluZS5jb22CC2hvdG1haWwuY29tghZtYWlsLnNlcnZpY2Vz
LmxpdmUuY29tgg1vZmZpY2UzNjUuY29tggtvdXRsb29rLmNvbYISb3V0bG9vay5v
ZmZpY2UuY29tghRzdWJzdHJhdGUub2ZmaWNlLmNvbYIYc3Vic3RyYXRlLXNkZi5v
ZmZpY2UuY29tMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
KwYBBQUHAwIwgY0GA1UdHwSBhTCBgjA/oD2gO4Y5aHR0cDovL2NybDMuZGlnaWNl
cnQuY29tL0RpZ2lDZXJ0Q2xvdWRTZXJ2aWNlc0NBLTEtZzEuY3JsMD+gPaA7hjlo
dHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRDbG91ZFNlcnZpY2VzQ0Et
MS1nMS5jcmwwPgYDVR0gBDcwNTAzBgZngQwBAgIwKTAnBggrBgEFBQcCARYbaHR0
cDovL3d3dy5kaWdpY2VydC5jb20vQ1BTMHwGCCsGAQUFBwEBBHAwbjAlBggrBgEF
BQcwAYYZaHR0cDovL29jc3B4LmRpZ2ljZXJ0LmNvbTBFBggrBgEFBQcwAoY5aHR0
cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0Q2xvdWRTZXJ2aWNlc0NB
LTEuY3J0MAwGA1UdEwEB/wQCMAAwggF/BgorBgEEAdZ5AgQCBIIBbwSCAWsBaQB2
ACl5vvCeOTkh8FZzn2Old+W+V32cYAr4+U1dJlwlXceEAAABfK/g3VUAAAQDAEcw
RQIgEt9eq7B2IxIdldx7ylZWV78J72tkIHEcAbUgfCu5ansCIQDBnmP8F/qhN18T
pMcWEWkYHpecO4Zy6EeK4lujQJWmOAB3AEHIyrHfIkZKEMahOglCh15OMYsbA+vr
S8do8JBilgb2AAABfK/g3WQAAAQDAEgwRgIhAP8wWN7x73Caqb+/fyTn19xeFoSu
I1WCts+o9kFBTAMzAiEA+PyWTgsTQaPNFjKD9gpZqB9YhmJ+n9Ys3MKztUdMbx0A
dgDfpV6raIJPH2yt7rhfTj5a6s2iEqRqXo47EsAgRFwqcwAAAXyv4N1fAAAEAwBH
MEUCIQDQayxy6lKEE+OSljnbJ9eSouYXhfuUqVY2GUHx23YZ/gIgHm5RAo4dGarS
B1ancMDzJJnLbHWwlj1a5ToKhE4/BvEwDQYJKoZIhvcNAQELBQADggEBAEVng9JF
K+j5PepUPnRsusd3bHj34Ou7YFWDbNZPLNQ32+i+SYvFP2p8+MGFh8QFAAvRGZr9
uvSJYELwNF4zkOQRgxOMEGMYBv0fI5H2xm54foKVZg8sx7GQvUn0T0tgIIZHR+gt
VdTJ6igJvUnp3sReBo9n4lWgoPS2pGGzQWfYKt/W1cOikrqtl7sDvnFZZcbyAIwq
Hibc4wsDz7IEFFXkXDXtpkz7tagnWRvnYi3cVBRR8h3g4LQniSqvOZ9QXJrum8IJ
elozNOiWsYmXNBr73YAFN1VaseQJhhuK9SFynph/Mowxg05V485RAWe+h3PBXYbm
My/pTsQCXeCan9A=
-----END CERTIFICATE-----
subject=C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = outlook.com

issuer=C = US, O = DigiCert Inc, CN = DigiCert Cloud Services CA-1

---
No client certificate CA names sent
Client Certificate Types: RSA sign, DSA sign, ECDSA sign
Requested Signature Algorithms: RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA1:ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA1:DSA+SHA1:RSA+SHA512:ECDSA+SHA512
Shared Requested Signature Algorithms: RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:ECDSA+SHA256:ECDSA+SHA384:RSA+SHA512:ECDSA+SHA512
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: ECDH, P-384, 384 bits
---
SSL handshake has read 4382 bytes and written 513 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 7447000060AE6E7111300831D4BFE4AC8FA6F941E469335B761541266618D4BE
    Session-ID-ctx: 
    Master-Key: 25E6C23E8708E854215B337B4A9D174478D470B0E29DD7D79C1F80ABBF4AEE31D558D49505A5C6797ABC43F54C5A61CC
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1639608692
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: yes
---
250 SMTPUTF8
^C

[JerryUrena]

I see that you only have one error there No client certificate CA names sent

now try within PHP with this code hopefully it works for you.

`<?php
$fp = stream_socket_client('smtp.office365.com:587', $errno, $errstr, 30);
if (!$fp)
{
echo "$errstr ($errno)\n";
} else
{

//issue will be reproduced here
stream_socket_enable_crypto($fp, true, STREAM_CRYPTO_METHOD_TLSv1_2_SERVER);

echo "Success!\n";
fclose($fp);
}`

@tianon Thanks for the fast reply