SSL operation failed with code 1. OpenSSL Error messages:

PHP prints the warning on two lines: "SSL operation failed with code 1. OpenSSL Error messages:" followed by the OpenSSL error(s). OpenSSL 1.1.1 builds show "error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed" instead.

PHP streams (file_get_contents, fopen, stream_socket_client, SoapClient, mail libraries) — openssl stream wrapper

What it means

A PHP stream (file_get_contents, fopen, SoapClient, stream_socket_client and the mail or FTP libraries built on them) failed its TLS handshake. Code 1 is OpenSSL's SSL_ERROR_SSL; the actual reason is on the next line, most often "error:0A000086:SSL routines::certificate verify failed". PHP then adds "Failed to enable crypto" and "Failed to open stream: operation failed", which are consequences, not causes.

Why it happens

• The server's CA is not trusted

  common

  A private or proxy CA, or a server that omits its intermediate certificate.

• PHP streams have no usable CA bundle

  common

  openssl.cafile is unset on systems where OpenSSL's default path has no bundle (Windows, minimal images).

• A protocol or cipher failure

  occasional

  With other reasons on the second line ("unsupported protocol", "alert handshake failure"), the server and PHP have no TLS version or cipher in common.

How to fix it

1. 1.

   Read the OpenSSL line that follows

   "certificate verify failed" points to trust or dates; protocol errors point to the server's TLS configuration.

   Warning: file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages:
   error:0A000086:SSL routines::certificate verify failed      <- trust/chain/date problem
   Warning: file_get_contents(): Failed to enable crypto       <- consequence, not the cause

2. 2.

   Set openssl.cafile

   PHP streams use openssl.cafile (or openssl.capath); ext-curl uses curl.cainfo, so set both.

   ; php.ini — CA bundle for PHP streams (file_get_contents, SoapClient, stream_socket_client)
   openssl.cafile = "/etc/ssl/certs/ca-certificates.crt"

3. 3.

   Pass a CA for one request

   A stream context with ssl.cafile trusts a private CA without weakening verification for anything else.

   // One request with a private CA; verification stays on
   $context = stream_context_create(['ssl' => [
       'cafile' => '/etc/ssl/private-ca/corp-root-ca.pem',
       'verify_peer' => true,
       'verify_peer_name' => true,
   ]]);
   $body = file_get_contents('https://api.example.com/', false, $context);

← Browse the full signature error database