{"action":"created","issue":{"url":"https://api.github.com/repos/composer/composer/issues/5981","repository_url":"https://api.github.com/repos/composer/composer","labels_url":"https://api.github.com/repos/composer/composer/issues/5981/labels{/name}","comments_url":"https://api.github.com/repos/composer/composer/issues/5981/comments","events_url":"https://api.github.com/repos/composer/composer/issues/5981/events","html_url":"https://github.com/composer/composer/issues/5981","id":196467084,"number":5981,"title":"[Feature] Add SSL option to set verify_peer to false","user":{"login":"onigoetz","id":309594,"avatar_url":"https://avatars.githubusercontent.com/u/309594?v=3","gravatar_id":"","url":"https://api.github.com/users/onigoetz","html_url":"https://github.com/onigoetz","followers_url":"https://api.github.com/users/onigoetz/followers","following_url":"https://api.github.com/users/onigoetz/following{/other_user}","gists_url":"https://api.github.com/users/onigoetz/gists{/gist_id}","starred_url":"https://api.github.com/users/onigoetz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/onigoetz/subscriptions","organizations_url":"https://api.github.com/users/onigoetz/orgs","repos_url":"https://api.github.com/users/onigoetz/repos","events_url":"https://api.github.com/users/onigoetz/events{/privacy}","received_events_url":"https://api.github.com/users/onigoetz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2016-12-19T16:58:17Z","updated_at":"2016-12-20T08:09:46Z","closed_at":null,"body":"This is not related to a specific project but on to Composer in General.\r\n\r\nIn the company I work for, we have a Man in the middle proxy for all our internet access.\r\nWith the latest changes in Composer it's impossible for us to download anything with HTTPs, we get the following Error.\r\n\r\n```\r\n  - Installing psr/http-message (1.0.1) Downloading: Failed       \r\n Downloading: Failed       \r\n Downloading: Failed    Failed to download psr/http-message from dist: The \"https://api.github.com/repos/php-fig/http-message/zipball/f6561bf28d520154e4b0ec72be95418abe6d9363\" file could not be downloaded: SSL operation failed with code 1. OpenSSL Error messages:\r\nerror:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed\r\nfailed to open stream: Cannot connect to HTTPS server through proxy\r\n    Now trying to download from source\r\n```\r\n\r\nI tracked down the problem to the fact that the http streams API doesn't allow self-signed certificates.\r\n\r\nMy certificates are installed correctly in `/etc/ssl/certs/ca-certificates.crt` and all other tools work fine (curl, wget ...) So the issue is not with my certificates.\r\n\r\nCan we add a configuration `verify-peer: false` to composer's configuration ? \r\nOr change the behaviour of `disable-tls` to use `verify_peer: false` in the streams configuration instead of trying each url with HTTP (as the web is more and more encrypted, an option without HTTP may not be available.\r\n\r\nI can create a pull request for any of both proposals. But I wanted to start a discussion first."},"comment":{"url":"https://api.github.com/repos/composer/composer/issues/comments/268180661","html_url":"https://github.com/composer/composer/issues/5981#issuecomment-268180661","issue_url":"https://api.github.com/repos/composer/composer/issues/5981","id":268180661,"user":{"login":"alcohol","id":21414,"avatar_url":"https://avatars.githubusercontent.com/u/21414?v=3","gravatar_id":"","url":"https://api.github.com/users/alcohol","html_url":"https://github.com/alcohol","followers_url":"https://api.github.com/users/alcohol/followers","following_url":"https://api.github.com/users/alcohol/following{/other_user}","gists_url":"https://api.github.com/users/alcohol/gists{/gist_id}","starred_url":"https://api.github.com/users/alcohol/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alcohol/subscriptions","organizations_url":"https://api.github.com/users/alcohol/orgs","repos_url":"https://api.github.com/users/alcohol/repos","events_url":"https://api.github.com/users/alcohol/events{/privacy}","received_events_url":"https://api.github.com/users/alcohol/received_events","type":"User","site_admin":false},"created_at":"2016-12-20T08:09:46Z","updated_at":"2016-12-20T08:09:46Z","body":"Just have your ssl connections terminate at the proxy (making that your single point of entry). Then from there on, forward all requests as regular http to internal applications/servers. Use a valid ssl certificate on the proxy. Problem solved. Look into ssl-offloading, e.g. similar to this https://www.nginx.com/resources/wiki/start/topics/examples/SSL-Offloader/"}}
{"actor":{"display_login":"alcohol"}}