PHPMailer 5.2 OpenSSL Error messages: error:140900

Question

I'm getting this error with PHPMailer on a PHP 5.6 server.

Warning: stream_socket_enable_crypto(): SSL operation failed with code 1. OpenSSL Error messages: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed in class.smtp.php on line 344

The interesting thing is I'm trying to send email through the local SMTP server @ localhost, and I'm not using SSL or TLS - it's plain SMTP on port 25.

$mail->SMTPSecure=''
$mail->SMTPPort //not set

The server has a valid SSL Certificate installed for the website domain.

I've read the documentation on GitHub about PHP 5.6 certificate verification failure and it doesn't seem to address this scenario.

I've added this code, but still receive the error:

$mail->SMTPOptions = array(
    'ssl' => array(
        'verify_peer' => false,
        'verify_peer_name' => false,
        'allow_self_signed' => true
    )
);

I guess the main question is, what SSL certificate, or lack thereof is it complaining about?

Answer 1

PHPMailer's github page mentions this type of error:

This is covered in the troubleshooting docs. PHP 5.6 verifies SSL certificates by default, and if your cert doesn't match, it will fail with this error. The correct solution is to fix your SSL config - it's not PHP's fault!

I see that you've gone through the trouble of making the PHPMailer settings insecure as is not recommended in the troubleshooting docs. Did you notice that requires PHPMailer 5.2.10?

The correct fix for this is to replace the invalid, misconfigured or self-signed certificate with a good one. Failing that, you can allow insecure connections via the SMTPOptions property introduced in PHPMailer 5.2.10 (it's possible to do this by subclassing the SMTP class in earlier versions), though this is not recommended

There's also suggestions for enabling debug output:

$mail->SMTPDebug = 4;

If you look at the debug output, you may glean more helpful info.

EDIT: this also is not about your website's cert, it's about the cert (if any) being hosted by your SMTP mail server endpoint.