Composer diagnose yielding an error 60 message no matter what I do!

I’ve been facing this issue for a number of days now, and I’m becoming desperate. I’d be extremely grateful for any help!

I’m trying to install cakephp on my Window 11-based laptop and when I run composer diagnose I’m continually confronting an extremely persistent error 60, which occurs whether or not I have disabled TLS

Checking platform settings: OK
Checking git settings: OK git version 2.46.2
Checking http connectivity to packagist: OK
Checking https connectivity to packagist: FAIL
[Composer\Downloader\TransportException] curl error 60 while downloading https://repo.packagist.org/packages.json: SSL certificate problem: unable to get local issuer certificate
Checking connectivity to http://repo.packagist.org: OK
Checking github.com rate limit: FAIL
[Composer\Downloader\TransportException] curl error 60 while downloading https://api.github.com/rate_limit: SSL certificate problem: unable to get local issuer certificate
Checking disk free space: OK
Checking pubkeys:
Tags Public Key Fingerprint: 57815BA2 7E54DC31 7ECC7CC5 573090D0  87719BA6 8F3BB723 4E5D42D0 84A14642
Dev Public Key Fingerprint: 4AC45767 E5EC2265 2F0C1167 CBBB8A2B  0C708369 153E328C AD90147D AFE50952
OK
Checking Composer version: FAIL
[Composer\Downloader\TransportException] curl error 60 while downloading https://getcomposer.org/versions: SSL certificate problem: unable to get local issuer certificate
Checking Composer and its dependencies for vulnerabilities: Failed performing audit: curl error 60 while downloading https://packagist.org/api/security-advisories/: SSL certificate problem: unable to get local issuer certificate
Composer version: 2.8.5
PHP version: 8.1.14
PHP binary path: C:\php\php.exe
OpenSSL version: OpenSSL 1.1.1s  1 Nov 2022
curl version: 7.77.0 libz 1.2.12 ssl OpenSSL/1.1.1s
zip: extension present, unzip not available, 7-Zip not available.

As far as I can see, the immediately relevant system variables are:
COMPOSER_SSL_CAINFO = C:\Program Files\Common Files\SSL\cacert.pem (recent file present)
CURL_CA_BUNDLE = C:\curl-openssl\bin\curl-ca-bundle.crt
CURL_SSL_BACKEND = openssl
SSL_CERT_FILE = C:\Program Files\Common Files\SSL\cacert.pem (see above)
OPENSSL_CONF = C:\Program Files\OpenSSL-Win64\ssl\openssl.cnf (recent file present)

Paths:
C:\curl-openssl\bin (this is the first path on my path list)
C:\WINDOWS\System32\OpenSSH
%SYSTEMROOT%\System32\OpenSSH
C:\php
C:\ProgramData\ComposerSetup\bin
C:\Program Files\OpenSSL-Win64\bin

Relevant entries in php.ini (in C:\php):
extension=curl
extension=openssl
curl.cainfo =“C:\curl-openssl\bin\curl-ca-bundle.crt”
openssl.cafile=“C:\curl-openssl\bin\curl-ca-bundle.crt”

Given that up-to-date files of the required name are present on all the paths provided, is there something wrong or missing there, or should I be looking somewhere else?

The versions I have installed are as follows (from the composer diagnose command):

Composer version: 2.8.5
PHP version: 8.1.14
PHP binary path: C:\php\php.exe
OpenSSL version: OpenSSL 1.1.1s  1 Nov 2022
curl version: 7.77.0 libz 1.2.12 ssl OpenSSL/1.1.1s

Given that up-to-date files of the required name are present on all the paths provided, is there something wrong or missing somewhere in the configuration, or should I be looking somewhere else?

Please let me know if you need more information.

Thanks very much to the Cakephp community in advance!

Edit: When I run curl --version, I guess I’m seeing that cURL is now defaulting to LIbreSSL/3.8.2 (presumably instead of OpenSSL).

curl 8.6.0 (x86_64-w64-mingw32) libcurl/8.6.0 LibreSSL/3.8.2 zlib/1.3.1 brotli/1.1.0 zstd/1.5.5 WinIDN libpsl/0.21.5 libssh2/1.11.0 nghttp2/1.59.0 ngtcp2/1.3.0 nghttp3/1.2.0
Release-Date: 2024-01-31
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS brotli HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6 Largefile libz NTLM PSL SSL threadsafe UnixSockets zstd

Yet the composer diagnose command makes reference to OpenSSL (see above, OpenSSL version: OpenSSL 1.1.1s 1 Nov 2022).

Have I simply installed the wrong build of OpenSSL (one built with LibreSSL instead of OpenSSL)?

Or can I get around my problem by abandoning OpenSSL and somehow getting composer to use either Schannel or LibreSSL?

Thats the main problem in my opinion :sweat_smile:

Windows is just a major pain in the ass to work with when developing stuff. I’d rather recommend you try WSL2 or something docker base where you are actually inside linux and not Windows.

Pretty sure you are running in to a windows specific issue related to composer

1 Like

Thanks Kevin!

I think I’m going to try your suggestion.

It seems far more logical than continuing to bang my head against a brick wall in the Windows environment.

Your view also neatly explains why I have received practically no replies to my questions on various fora on the web: people largely don’t use Cake in a Windows environment.

tips hat

It’s certainly possible to get all of this working in a Windows environment, but it’s best to develop in the same environment as the site will eventually be hosted in, and that’s almost certain to be Linux. The number of questions that come up about “this worked in my dev system but is broken in production” and it ends up being case sensitivity issues…