33

my network does not work well with https, so doing

composer.phar install

throws

  [Composer\Downloader\TransportException]                                                         
  The "https://packagist.org/packages.json" file could not be downloaded: Failed to enable crypto  
  failed to open stream: operation failed  

i used

{
    "packagist": false
},
{
    "type": "composer",
    "url": "http://packagist.org",
    "options": {
        "ssl": {
            "verify_peer": "false"
        }
    }
}

as a http falback, but again it crashes in some other point:

Installing dependencies
  - Installing symfony/translation (v2.4.0)
    Downloading: 100%         
    Downloading: 100%         
    Downloading: 100%         



  [Composer\Downloader\TransportException]                                                                                                          
  The "https://api.github.com/repos/symfony/Translation/zipball/0919e0fc709217f8c9e5049f2603419fdd4a34ff" file could not be downloaded: Failed to   
  enable crypto                                                                                                                                     
  failed to open stream: operation failed               

my problem is just with TLSv1, previous SSL versions should work, as the browsers work correctly.

how should i do, the problem also exists in other cmd tools that depend on https like npm, bower, git, curl, ...

1
  • why "packagist": false? what does that do? Jul 18, 2016 at 10:56

6 Answers 6

46
composer config --global disable-tls true
composer config --global secure-http false
0
17

You can turn off TLS (For your specific project) using your composer.json as such:

{
    "require": {
        "laravel/framework": "5.2.43"
    },
    "config": {
        "preferred-install": "dist",
        "disable-tls": true,
        "secure-http": false
    }    
}

NB: Take not of the "disable-tls": true in the config section.

3
  • 2
    still it is not working after updating above config.. I am getting same error Aug 8, 2017 at 10:54
  • Are you using a proxy server to access the internet? You might want to set the proxy in your command prompt as such: set HTTPS_PROXY=[IP:PORT] before retrying your composer.
    – Gamma.X
    Aug 12, 2017 at 17:51
  • No.. I am not using any proxy Aug 17, 2017 at 3:54
10

The problem is simply that you wrapped "false" in quotes, which is true when converted to bool.

Use "verify_peer": false instead of "verify_peer": "false":

{
  "repositories": [
    {
      "type": "composer",
      "url": "http://packagist.org",
      "options": {
        "ssl": {
          "verify_peer": false
        }
      }
    }
  ]
}
6

It's okey. It will work. You just have a mismatch:

"options": {
    "ssl": {
        "verify_peer": false
    }
}
4

in order to disable https totaly (not recommanded) you need to add "secure-http": false in your composer.json file config key like this:

{
    "name": "laravel/laravel",
    "description": "The Laravel Framework.",
    "keywords": ["framework", "laravel"],
    "license": "MIT",
    "require": {
        "laravel/framework": "5.3.*",
    },

    ...

    "config": {
        "preferred-install": "dist",
        "bin-dir": "vendor/bin/",
        "secure-http": false
    },
    "minimum-stability": "dev"
}
1
  • I just learned that on newer composer versions (e.g. 2.2.7) while using packagist (default with composer), the additional step to use http for packagist is required as well. The settings given here are fine however with composer 1.10.6 from what I can see (only tested with global composer config).
    – hakre
    Apr 2, 2022 at 21:12
2

You cannot disable SSL with Composer. Even if it works like in your setup, you cannot control the source URLs of any package you use. Some of them do not offer anything without SSL, so you MUST use SSL.

I think it's the best idea to make SSL work. Did you try composer diag and see where the problem is?

10
  • 1
    composer diag throws exaxtly the same error: [Composer\Downloader\TransportException] The "https://packagist.org/packages.json" file could not be downloaded: Failed to enable crypto failed to open stream: operation failed
    – pajooh
    Jan 7, 2014 at 10:23
  • "Make SSL work" is the only solution I have for you. I cannot help you with that because I don't know what is broken, but if other tools are also broken, then some basic element is to blame, i.e. a shared library or something like that.
    – Sven
    Jan 7, 2014 at 19:00
  • the problem is not my machine specific, there is a proxy or something in my internet path that prevents proper TLS negotiation, and blaming this proxy will not solve my problem, i need a working solution!
    – pajooh
    Jan 8, 2014 at 5:48
  • 1
    I have to repeat myself: Your internet connection is broken. Fix the proxy or whatever is interfering. I'd consider it inacceptable to not be able to use the latest TLS 1.2 version if I so desire. And effectively it will not help you to disable SSL in Composer or downgrade to SSLv3 because you cannot control the server having the sources you need. If there is no non-SSL URL available, or it does not allow using SSLv3, then it will never work anyway.
    – Sven
    Jan 8, 2014 at 20:23
  • 1
    this problem exists for so many people already and it has been so for at least months for each of them. I'd rather disable ssl verification and get on with my work thank you Jul 18, 2016 at 10:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.