The OpenSSL wiki page says this: "It is strongly recommended that all new applications call OPENSSL_config()". *strongly recommended* they say.

Arguing that curl didn't "load openssl.cnf" before 7.37.1 isn't that interesting. Whenever curl has a bug that we fix, there was something it didn't do until we fixed it. Not calling OPENSSL_config() clearly was a bug since adding the call fixed one or more problems.

We knew there was a possibility for problems with this function as that had been reported before. But we also didn't have any other means to for example fix the engine problem.

I can't answer to what PHP does and what it should or shouldn't do. I need to focus on what libcurl should do when it uses OpenSSL. So please in this bug tracker we focus on what we think libcurl should do. libcurl is used by thousands of other applications and users, not just PHP.

I still believe you're mostly identifying problems in OPENSSL_config(). Do you agree? Have you discussed this matter with the OpenSSL team?

Finally, I would also like to point out that libcurl has a flag to curl_global_init() that makes it avoid "initing" openssl, which is intended to be used by users who use openssl in several places. Perhaps that's for you?

---
** [bugs:#1401] STR_COPY:variable has no value**
**Status:** open
**Labels:** openssl VC9 VC11 Windows 2008 
**Created:** Sun Jul 27, 2014 06:54 AM UTC by Jan-E
**Last Updated:** Mon Jul 28, 2014 12:05 PM UTC
**Owner:** Daniel Stenberg
I got this error after upgrading to libcurl 7.37.1 and compiling php_curl.dll with it on Windows
	C:\phpdev\php55nts.x32>php -v
	Auto configuration failed
	7140:error:0E065068:configuration file routines:STR_COPY:variable has no value:.
	\crypto\conf\conf_def.c:618:line 37
To analyze what went wrong, I went back to libcurl 7.37.0 and applied the openssl patches since that release:
7.37.0 unpatched: OK
7.37.0 with the 'Fix uninitialized variable use in NPN callback': still OK
7.37.0 with the additional 'call OPENSSL_config for initing engines' patch: error
So this commit broke it on my server:
https://github.com/bagder/curl/commit/c50ce859187cabecee5470a95a51c35bf73d3c47
OS: Windows 2008 R2
OpenSSL 1.0.1h
PHP-versions: 5.3-29-dev, 5.4.31, 5.5.15
So it happened both with PHP compiled with VC9 (5.3, 5.4) as with PHP compiled with VC11 (5.5).
Other point that is relevant: it only happened on the production server. I could not reproduce it on the developmet server, which runs Windows 2008 R2 as well. And also on my laptop with Windows 7 it did not happen.
Furthermore: it went wrong with every php-extension that used libcurl (php_http.dll for instance).
---
Sent from sourceforge.net because curl-tracker@cool.haxx.se is subscribed to https://sourceforge.net/p/curl/bugs/
To unsubscribe from further messages, a project admin can change settings at https://sourceforge.net/p/curl/admin/bugs/options.  Or, if this is a mailing list, you can unsubscribe from the mailing list.