Peer certificate subjectAltName did not match expected name `api.example.com'

PHP quotes the expected name with a backtick before it and an apostrophe after it. Certificates without a SAN extension produce "Peer certificate CN=`…' did not match expected CN=`…'" instead. ext-curl based clients (Guzzle) report the same situation as cURL error 60 with "no alternative certificate subject name matches target hostname".

PHP streams (openssl stream wrapper) — verify_peer_name check

What it means

The certificate chain verified, but none of the certificate's Subject Alternative Names matches the name PHP expected (the host from the URL, or the peer_name context option). PHP's stream wrapper performs this check itself after the handshake and refuses the connection, followed by "Failed to enable crypto".

Why it happens

• The certificate does not list the host name

  common

  The URL uses a name the certificate was not issued for.

• Connecting by IP or an internal alias

  common

  Common with database, LDAP and SMTP connections configured with IP addresses.

• SMTP relays reached under a different name

  occasional

  Mailers configured with "localhost" or a provider alias while the server presents a certificate for its public name.

How to fix it

1. 1.

   Compare the SAN list with the host

   The message names the expected host; the certificate's SANs show what is covered.

   echo | openssl s_client -connect api.example.com:443 -servername api.example.com 2>/dev/null \
     | openssl x509 -noout -ext subjectAltName

2. 2.

   Set peer_name when connecting by address

   The ssl context option peer_name tells PHP which name to verify while the socket connects to an IP address.

   // Connect to an address but verify the certificate's real name
   $context = stream_context_create(['ssl' => ['peer_name' => 'mail.example.com']]);
   $socket = stream_socket_client('tls://10.0.0.25:465', $errno, $errstr, 10, STREAM_CLIENT_CONNECT, $context);

3. 3.

   Use the certificate's host name in DSNs

   Configure mailers and clients with the name the server's certificate carries.

   # Mail libraries (PHPMailer, Symfony Mailer): use the SMTP host name from the certificate
   MAILER_DSN=smtp://user:pass@mail.example.com:587

← Browse the full signature error database