Up until 7.37.0 curl did not load openssl.cnf, now it does. Even with a openssl.cnf without errors this is a change of behaviour that could break things. Take a look at drook's comment in #83: https://sourceforge.net/p/curl/bugs/1208/#488e

If a PHP extension deliberately loads another than the default openssl.cnf it now depends on the extension loading order which openssl.cnf is actually loaded. drook's intention was to find a solution "regardless of the module loading order". As far as I can see, with libcurl the loading order now matters.

PHP ignores any OPENSSL_CONF environment setting, see https://bugs.php.net/bug.php?id=64501. PHP is distributed with a openssl.cnf in the extras/ssl directory. What if php-curl tries to load the OPENSSL_CONF one and other extensions the one from extras/ssl? Which one will prevail? Maybe Pierre Joye can shine a light on this. I will point him to this discussion.

---
** [bugs:#1401] STR_COPY:variable has no value**
**Status:** open
**Labels:** openssl VC9 VC11 Windows 2008 
**Created:** Sun Jul 27, 2014 06:54 AM UTC by Jan-E
**Last Updated:** Mon Jul 28, 2014 07:08 AM UTC
**Owner:** Daniel Stenberg
I got this error after upgrading to libcurl 7.37.1 and compiling php_curl.dll with it on Windows
	C:\phpdev\php55nts.x32>php -v
	Auto configuration failed
	7140:error:0E065068:configuration file routines:STR_COPY:variable has no value:.
	\crypto\conf\conf_def.c:618:line 37
To analyze what went wrong, I went back to libcurl 7.37.0 and applied the openssl patches since that release:
7.37.0 unpatched: OK
7.37.0 with the 'Fix uninitialized variable use in NPN callback': still OK
7.37.0 with the additional 'call OPENSSL_config for initing engines' patch: error
So this commit broke it on my server:
https://github.com/bagder/curl/commit/c50ce859187cabecee5470a95a51c35bf73d3c47
OS: Windows 2008 R2
OpenSSL 1.0.1h
PHP-versions: 5.3-29-dev, 5.4.31, 5.5.15
So it happened both with PHP compiled with VC9 (5.3, 5.4) as with PHP compiled with VC11 (5.5).
Other point that is relevant: it only happened on the production server. I could not reproduce it on the developmet server, which runs Windows 2008 R2 as well. And also on my laptop with Windows 7 it did not happen.
Furthermore: it went wrong with every php-extension that used libcurl (php_http.dll for instance).
---
Sent from sourceforge.net because curl-tracker@cool.haxx.se is subscribed to https://sourceforge.net/p/curl/bugs/
To unsubscribe from further messages, a project admin can change settings at https://sourceforge.net/p/curl/admin/bugs/options.  Or, if this is a mailing list, you can unsubscribe from the mailing list.