PHPMailer generates PHP Warning: stream_socket_enable_crypto(): Peer certificate did not match expected

Question

I am using PHPMailer on PHP 5.6, the increased security around certificated in PHP 5.6 is certainly fun.

I am trying to send a test message to a domain hosted on dreamhost, the error that comes back from PHPMailer is: Could not connect to SMTP host.

That error is not right though, I have logging enabled and here is what is actually going on.

Connection: opening to mx1.sub4.homie.mail.dreamhost.com:25, timeout=30, options=array ( ) Connection: opened S: 220 homiemail-mx32.g.dreamhost.com ESMTP

C: EHLO s81a.ikbb.com

S: 250-homiemail-mx32.g.dreamhost.com 250-PIPELINING 250-SIZE 40960000 250-ETRN 250-STARTTLS 250-ENHANCEDSTATUSCODES 250 8BITMIME

C: STARTTLS

S: 220 2.0.0 Ready to start TLS

C: QUIT

S: SMTP ERROR: QUIT command failed: Connection: closed

I could not understand why PHPMailer just gives up, issuing a QUIT command when it should start sending the message. I got another clue from another log:

PHP Warning: stream_socket_enable_crypto(): Peer certificate CN= *.mail.dreamhost.com' did not match expected CN= mx1.sub4.homie.mail.dreamhost.com' in /home/ikbb/domains/dev.ikbb.com/public_html/includes/phpmailer/5.2.10/class.smtp.php

If I use some custom options to prevent validation of the cert they are using I can get it to continue. Here is what I have:

        $mail->SMTPOptions = array (
        'ssl' => array(
            'verify_peer'  => false,
            'verify_peer_name'  => false,
            'allow_self_signed' => true));

If I put the SMTPOptions in there and skip the peer verification, message goes OK - with no warning in PHP at all.

How can I trap that error, so I know there is an issue but still send the message?

Answer 1

I had the same problem and I found the answer in the PHPMailer documentation .

PHP 5.6 certificate verification failure

In a change from earlier versions, PHP 5.6 verifies certificates on SSL connections. If the SSL config of the server you are connecting to is not correct, you will get an error like this:

Warning: stream_socket_enable_crypto(): SSL operation failed with code 1.
OpenSSL Error messages: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

The correct fix for this is to replace the invalid, misconfigured or self-signed certificate with a good one. Failing that, you can allow insecure connections via the SMTPOptions property introduced in PHPMailer 5.2.10 (it's possible to do this by subclassing the SMTP class in earlier versions), though this is not recommended:

$mail->SMTPOptions = array(
    'ssl' => array(
        'verify_peer' => false,
        'verify_peer_name' => false,
        'allow_self_signed' => true
    )
);

You can also change these settings globally in your php.ini, but that's a really bad idea; PHP 5.6 made this change for very good reasons.

Sometimes this behaviour is not quite so apparent; sometimes encryption failures may appear as the client issuing a QUIT immediately after trying to do a STARTTLS. If you see that happen, you should check the state of your certificates or verification settings.

Answer 2

For PHP 5.6 use the following. Adding "tls://" is the key.

$mail->Host = gethostbyname('tls://smtp.gmail.com');

See: http://php.net/manual/en/context.ssl.php

Answer 3

For those of you using cPanel, I tried the SMTP check code from the examples folder in PHPMailer and I got this same error:

PHP Warning: stream_socket_enable_crypto(): Peer certificate  CN=*.mail.dreamhost.com' did not match expected CN=mx1.sub4.homie.mail.dreamhost.com' in /home/ikbb/domains/dev.ikbb.com/public_html/includes/phpmailer/5.2.10/class.smtp.php

I realized that it was not an error related to PHPMailer, so I searched for similar errors related to CentOS and I found this link that shed some light: Issue sending mails through 3rd party . You have to take a look at "SMTP Restrictions" in cPanel.

Answer 4

Solution for WHM/cPanel(s) : Disable SMTP Restriction by following below process:

a) Open WHM and search for SMTP restriction , make sure it's disable.(You can go through Home »Security Center »SMTP Restrictions directly as well)

b) Or Same thing can be done via Tweak Settings (Directly go for Home »Server Configuration »Tweak Settings or you can click on tweak setting link shown in upper image)

Answer 5

在 WHM 中禁用 SMTP 限制

Answer 6

I had a similar problem after I've upgraded to PHP 5.6 on my WordPress machine. The WP Mail SMTP by WPForms (wp-mail-smtp) plugin were configured to use localhost as SMTP Host. I've changed it to the FQHN (Fully Qualified Host Name) as it is defined in the SSL cert. After this change it is working fine.

Answer 7

As somebody mentioned here, the issue is an invalid SSL certificate. Your website might have a valid SSL certificate, but it might not apply to the mail.website.net or smtp.website.net subdomains. If your hosting provider has an interface for generating SSL certificates for your website, try to search if there isn't a possibility to select subdomains for which the certificate will generate.

Answer 8

If you just migrated to a different server, most likely you can fix this by disabling SMTP restriction from WHM. enter image description here

Answer 9

You might probably solved your problem already. But since other developer might be stucked on this, I will propose something that worked for me. I had the same problem with Laravel 4.2 Swiftmailer instead of PHPMailer, but with a Dreamhost VPS account. I didn't want to hack SMTP options verify_peer, allow_self_signed or set encryption from ssl to null. I didn't want neither to purchase a pro certificate for my Staging VPS, and I'm not on Production yet.

What I tried that didn't work from mail.php:

<?php
return array(

'driver' => 'smtp',

'host' => 'mail.mywebsite-staging.com',

'port' => 25,

'from' => array('address' => 'mywebsite@mywebsite-staging.com', 'name' => 'MyWebsite Staging'),

'encryption' => 'tls',

'username' => 'mywebsite@mywebsite-staging.com',

'password' => 'myPASS',

'sendmail' => '/usr/sbin/sendmail -bs',

'pretend' => false
);
?>

I found this Dreamhost Certificate Domain Mismatch Error documentation which tells us that our Mail server certificate resigns from a sub-domain (2 sub level) of dreamhost mail (*.mail.dreamhost.com) where * is a group that contains multiple mail accounts.

You have to go to:

• Dreamhost Web Panel > Support > Data-Centers

and you will see what group your mail server belongs to, so you'll know which host to use in mail.php.

• homiemail-sub3 => sub3.mail.dreamhost.com
• homiemail-sub4 => sub4.mail.dreamhost.com
• homiemail-sub5 => sub5.mail.dreamhost.com
• homiemail-master => homie.mail.dreamhost.com

Mine was homiemail-sub4, then I used 'host' => 'sub4.mail.dreamhost.com',

Then no certificate problem. If using Mail Server from another Provider then try to check it wild is use also for your mail certificate.