Solved: Unable to get composer running to install CraftCMS

Question

for last weeks really I try to install composer, but it keeps complaining about SSL-problems. I searched everywhere on Google and found lots of people having the same problems, but for some reason they found solutions which don't work here.

I really need to install composer, 'cause I like to use Craft 3, but whatever I try, it's not working. There is no composer-forum, and I guess all you guys needed to use composer to install Craft 3 too, so I hope somebody here can help. I'm really out of ideas at the moment...

I tried this:

SETUP VIA WINDOWS INSTALLER

• Download and run windows installer Composer 1.6.5: https://getcomposer.org/download/ I see the path is pointing to the right php.exe (and the same php I use on wamp server). I don't use a proxy.
• Running composer after install shows me composer is installed.
• Running composer diagnose however shows me a WARNING after https connectivity to packagist: The https://packagist.org/packages.json file could not be downloaded: SSL operation failed with code 1.
• So in php I checked if php_openssl is enabled and it is.
• I also have this in my php.ini file, pointing to a cacert.pem certificate, downloaded from http://curl.haxx.se/ca/cacert.pem : openssl.cafile="C:\caCertificates\cacert.pem" openssl.capath="C:\caCertificates\"
• Running php --ini on cmdline I verified it's definitely the edited php.ini file that is active on command line/composer use (C:\wamp64\bin\php\php7.1.16)
• I turned firewall off
• I even uninstalled wamp-server with all php-stuff and installed a complete fresh, updated, install of Wamp server (3.1.3 64b)
• But composer diagnose keeps throwing the warning, and composer is not working.

SETUP VIA PHP INSTALLER
Than I tried the php-install script I found on getcomposer.org and run this from command line:
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" php -r "if (hash_file('SHA384', 'composer-setup.php') === '544e09ee996cdf60ece3804abc52599c22b1f40f4323403c44d44fdfdd586475ca9813a858088ffbc1f233e9b180f061') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;" php composer-setup.php php -r "unlink('composer-setup.php');"
- It returns with:
Installer verified. All settings correct for using Composer. Downloading... Composer (version 1.6.5) successfully installed to: C:\proj-folder\test\composer.phar
- But when I run composer diagnose in that test-folder it's still throwing the warning.

BTW I tried above with administrative rights too.

I understand this has something to do with SSLv3, but whatever I tried, nothing seems to fix the issue. And again I tried a lot of things that worked for other people having this issue.

I'm out of ideas and composer obviously is not really helpful in showing a clue to what's the problem here.

Is there anybody here that can help me with this, or give me some direction on where to look? This is taking a lot of time and effort last weeks without luck and I'd like to start building websites with Craft 3 using composer!! Thanks!

Answer 1

Yes, after lots of trying I finally found the solution!! It was ESET causing the problem

Today, after re-installing PHP7 from scratch (so not using wamp and its contents anymore to make sure it's not wamp setup causing these problems) and reinstalling composer again I found that even that didn't work.

So I figured it really should be in some anti-virus or other blocking tool. And I only use ESET Internet Security.

But I tried disabling both ESET firewall as well as ESET anti-virus several times before and it didn't solve the mystery of the composer connectionproblems. So I took a closer look at ESET advanced settings more deeply now and it seems that eventhough I thought I turned everything in ESETs scans and blocks completely off (and that's exactly what ESET displays!), there happens to be a SSL-scan that wasn't turned off by that so still actively preventing composer to work.

I would say scanning SSL communication by ESET shouldn't cause any problems anyhow, just some milliseconds delay or whatever, but it obviously was completely blocking composer from reaching packagist through ssl. Turning off the SSL scan made composer reach packagist with https immediately, so finally this solves the mystery.

For people coming here with the same problem with composer and SSL and use ESET too, if you set up php and composer correctly then you should try this on ESET to solve the problem:

• Enter ESET advanced setup (via rightclick menu on ESET icon)
• Open up 'Web and email', and then the 'SSL/TLS' tab
• Click the 'edit'-link after 'List of SSL/TLS filtered applications' (a dialog opens)
• Check if the php.exe composer is using is in the list and if it does: make sure the scan action is set to 'ignore'. That prevents ESET from scanning the traffic via SSL from php.exe. Perhaps you could also add some certificate to the 'List of known certificates' here, but I solved it this way instead.
• If php.exe is not in the list you should get a dialog window when running a composer command like 'composer diagnose' that needs ssl with packagist and ESET shows a dialog box for the new connection: set it to IGNORE. Scan will result in composer throwing warnings and having no connection with packagist.
• If php.exe is not in the list and you don't get the ESET dialog window for the new connection when running 'composer diagnose' either you probably don't have the 'SSL/TLS protocol filtering mode' in ESET (under 'web and email'/SSL/TLS tab in advanced settings) set to interactive mode. Set it to interactive mode than.
• If none of the above worked you could also choose to fully turn off all SSL/TLS protocol filtering in ESET by just switching it off in 'web and email' --> SSL/TLS --> Enable SSL/TLS protocol filtering. Then ESET isn't scanning any SSL anymore.

Hopefully this helps more people having the same issue.

Thisone really caused me headages for last weeks because it hold me back from switching to craft 3. So I'm really excited I finally got an answer to this now!! Finally it's time to move to the more important stuff!