Search code examples
phpopenssl

Apache/PHP Installing cypher for openssl() - missed in openssl_get_cipher_methods

I just migrated to PHP 8.1 from a very old server. Now I have the problem that openssl_encrypt returns false or an empty string as it doesnt' know BF-ECB engine what worked before on older server.

The command openssl_get_cipher_methods verifies this, no BF-ECB available. On the old server is OpenSSL1.1 on the new 3.0.

Can anyone help what do I need to install or tell my administrator?

Solution

  • See this excellent answer by Matt Caswell with for the explanation why this is happening and how to fix it. I had the same issue after upgrading to PHP 8.1, and found that bf-cbc was not available in OpenSSL 3.0 by default.

    In OpenSSL 3.0, Blowfish became a legacy cipher and is not loaded by default. When PHP tries to use that cipher for encryption it fails since it is not loaded and available for use.

    To make this work from PHP, the OpenSSL configuration file needs to be updated to enable legacy ciphers. Here are the steps to fix it.

    Look for the "Openssl default config" value in phpinfo(). The location will vary by platform. On a Debian box, it was /usr/lib/ssl/openssl.cnf. If there is no value for this setting, you'll need to find it or create a new openssl configuration file and set it in php.ini.

    php openssl configuration

    Next, open openssl.cnf in a text editor and find the settings section [provider_sect]. Below the line default = default_sect, add a line with legacy = legacy_sect.

    Finally, find the section [default_sect] and add this new section after it:

    [legacy_sect]
activate = 1

    With the comments removed, part of the config file should look similar to:

    [openssl_init]
providers = provider_sect
ssl_conf = ssl_sect

# List of providers to load
[provider_sect]
default = default_sect
legacy = legacy_sect

[default_sect]
activate = 1

[legacy_sect]
activate = 1

    Once the openssl configuration file is updated to load the legacy provider, Blowfish ciphers should now work and appear in the list of ciphers returned by openssl_get_cipher_methods() (sorted alphabetically).