wrong path succeeds in stream_context_set_options

[Playit3110]

Description

After Initiating a TCP-Server I wanted to enable TLS encryption with the following code:

$socket = stream_socket_server("tcp://0.0.0.0:8000", $errno, $errstr);


$options = [
    'ssl' => [
        'local_cert' => '/not/a/real/path/to/file.cert',
        'local_pk' => '/not/a/real/path/to/file.key',
    ],
];

echo stream_context_set_options($socket, $options);

After execution stream_context_set_options return true, even if the files for encrypting connections is missing

PHP Version

PHP 8.4.21 (cli) (built: May  7 2026 18:46:27) (NTS)
Copyright (c) The PHP Group
Built by Debian
Zend Engine v4.4.21, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.21, Copyright (c), by Zend Technologies

Operating System

Debian 13 Trixie

[LamentXU123]

Hi. As far as I can tell stream_context_set_options is for storing options, it doesn't have the functionality to validate your inputs. It returns true when the option is set and doesn't actually care about whether the file exists.

In other words, the failure will be raised later when you start to use that options you set (let's say possibly in stream_socket_enable_crypto or something else). The stream_context_set_options function only fails when it fails to set your option.

what do you think?

[Playit3110]

That can be true, but then there is no way to know if the client sent the correct handshake or if a key exists at all on the server. So is to be expected or should it check first, if it can load the key and certificate?

For example if a client sents a HTTP GET over http and not https. stream_socket_enable_crypto would fail to, but I dont know if it was because of the key or the client stream.

[LamentXU123]

In that case you could try to use the error_handler feature to capture errors for different reasons

<?php
set_error_handler(function($errno, $errstr) use (&$sslError) {
    $sslError = $errstr;
});
$result = stream_socket_enable_crypto($conn, true, STREAM_CRYPTO_METHOD_TLS_SERVER);
restore_error_handler();
if ($result === false) {
if (strpos($sslError, 'cert') !== false || strpos($sslError, 'key') !== false) {
// failed to load key error logic...
}
}