title: How to set trusted certificate authorities list to socket client in PHP?
body: <p>In the context of the IHE Connectathon, I want to make a raw socket server responsing to the ATNA profile, which requires TLS sockets with both ends certificates.</p>
  
  <p>My issue if summed up in this message :
  <a href="https://groups.google.com/d/msg/eu_connectathon/O-VGI_3cltw/ARsElA65ZkkJ" rel="nofollow">https://groups.google.com/d/msg/eu_connectathon/O-VGI_3cltw/ARsElA65ZkkJ</a></p>
  
  <p><strong>Edit</strong>: Sorry, the Google Groups isn't public, here is the message :</p>
  
  <blockquote>
    <p>Hi Florian,</p>
    
    <blockquote>
      <p>What exactly does the error message "Server asked for a certificate,
      but  list of issuers doesn't contain valid  certificate authority."
      mean and did the implementation of the TLS Tools  Client change during
      the last years, or am I using the wrong certificates?</p>
    </blockquote>
    
    <p>The message means that the server has sent the CertificateRequest
    message to the clienmt with no values in the certificate_authorities
    field.</p>
    
    <p>I ran into this problem last year and discussed this with a developer
    of the TLS Tools. He claimed that if a server didn't include this
    field, the client wouldn't have a clue what kind of certificate to
    return, assuming a scenario where you would connect top multiple
    affinity domains, each with their own CA.</p>
    
    <p>It appears that you can instruct OpenSSL to return this value by
    calling SSL_CTX_set_client_CA_list, e.g. in
    DcmTLSTransportLayer::addTrustedCertificateFile. I haven't tested this
    with the TLS tools yet, but I hope to accomplish that before the
    connectathon starts.</p>
  </blockquote>
  
  <p>But my implementation, in PHP, is not the same as their's.
  It looks like PHP is missing the "SSL CTX set client CA list" possibility, to tell the client which certificate authority it should use.</p>
  
  <pre><code>$context = stream_context_create();
  
  if ($certificate) {
    // Server certificate + private key
    stream_context_set_option($context, 'ssl', 'local_cert', "/path/to/server.pem"); 
    stream_context_set_option($context, 'ssl', 'passphrase', $passphrase); 
  
    // Client public certificates
    stream_context_set_option($context, 'ssl', 'cafile', "/path/to/ca.pem");
  
    stream_context_set_option($context, 'ssl', 'allow_self_signed', false);
    stream_context_set_option($context, 'ssl', 'verify_peer', true);
    stream_context_set_option($context, 'ssl', 'peer_name', "TlsTools2");
    stream_context_set_option($context, 'ssl', 'capture_peer_cert', true);
    stream_context_set_option($context, 'ssl', 'capture_peer_cert_chain', true);
  }
  
  $this-&gt;__socket = @stream_socket_server("tcp://$address:$port", $errno, $errstr, STREAM_SERVER_BIND | STREAM_SERVER_LISTEN, $context);
  </code></pre>
  
  <p>The IHE Gazelle TLS client tells me "Server asked for a certificate, but list of issuers doesn't contain valid certificate authority."</p>
  
  <p>The messages between client and server pass, but the test is not OK, as "not enough secure", as tells the message.</p>
  
  <p>Do you see a problem, and does PHP have more options I didn't see ?</p>
  
  <p>Thanks for your help.</p>
  
  <p><strong>Edit</strong>: As @rdlowrey suggested me, I just created a bug report : <a href="https://bugs.php.net/bug.php?id=69215" rel="nofollow">https://bugs.php.net/bug.php?id=69215</a></p>