zendframework/zf2 — pull request #5870 by icywolfy (2014-02-25 18:38:57+00:00)
Title: SSL CA File support.

On Centos 6;
And on my Ubuntu 13.04 system,
Using the default Socket client adapter doesn't work.
I've seen many people on the internet have the same issue.

The underlying issue is that these systems are incompatible with the ssl stream context options ```capath```. In that the directory contains a certificate bundle file and not (as the PHP manual states) a "correctly hashed certificate directory"

By using a the ```/etc/ssl/certs``` directory here (or it's resolved location of ```/etc/pki/tls/certs```, you end up with the Socket adapter giving the error:
```"error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed"```

The correct answer is to set the context option
```cafile`` to ```'/etc/ssl/certs/ca-bundle.crt'``` on these systems.
(I have seen on some client systems the filename being ```certificate-bundle.crt```)

As this option isn't built in, it's a bit awkward to use. Having to add a factory to manually make use of the cafile; rather than pass in the configuration array verbatim.
```php
$context = $client->getAdapter()->getStreamContext()
if (!stream_context_set_option($context, 'ssl', 'cafile', $sslcafile)) {
throw new AdapterException\RuntimeException('Unable to set sslcafile option');
}
```

If you set an non existant file, and have openssl_error_string, the result will be :
```
SSL error: error:02001002:system library:fopen:No such file or directory;
SSL error: error:2006D080:BIO routines:BIO_new_file:no such file;
SSL error: error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib

In addition to:
stream_socket_enable_crypto(): failed to create an SSL handle
stream_socket_enable_crypto(): Unable to set verify locations '/etc/ssl/certs/ca-bundle.cret'
```