for last weeks really I try to install composer, but it keeps complaining about SSL-problems. I searched everywhere on Google and found lots of people having the same problems, but for some reason they found solutions which don't work here.

I really need to install composer, 'cause I like to use Craft 3, but whatever I try, it's not working. There is no composer-forum, and I guess all you guys needed to use composer to install Craft 3 too, so I hope somebody here can help. I'm really out of ideas at the moment...

I tried this:


  • Download and run windows installer Composer 1.6.5: https://getcomposer.org/download/ I see the path is pointing to the right php.exe (and the same php I use on wamp server). I don't use a proxy.
  • Running composer after install shows me composer is installed.
  • Running composer diagnose however shows me a WARNING after https connectivity to packagist: The https://packagist.org/packages.json file could not be downloaded: SSL operation failed with code 1.
  • So in php I checked if php_openssl is enabled and it is.
  • I also have this in my php.ini file, pointing to a cacert.pem certificate, downloaded from http://curl.haxx.se/ca/cacert.pem : openssl.cafile="C:\caCertificates\cacert.pem" openssl.capath="C:\caCertificates\"
  • Running php --ini on cmdline I verified it's definitely the edited php.ini file that is active on command line/composer use (C:\wamp64\bin\php\php7.1.16)
  • I turned firewall off
  • I even uninstalled wamp-server with all php-stuff and installed a complete fresh, updated, install of Wamp server (3.1.3 64b)
  • But composer diagnose keeps throwing the warning, and composer is not working.

Than I tried the php-install script I found on getcomposer.org and run this from command line:
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" php -r "if (hash_file('SHA384', 'composer-setup.php') === '544e09ee996cdf60ece3804abc52599c22b1f40f4323403c44d44fdfdd586475ca9813a858088ffbc1f233e9b180f061') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;" php composer-setup.php php -r "unlink('composer-setup.php');"
- It returns with:
Installer verified. All settings correct for using Composer. Downloading... Composer (version 1.6.5) successfully installed to: C:\proj-folder\test\composer.phar
- But when I run composer diagnose in that test-folder it's still throwing the warning.

BTW I tried above with administrative rights too.

I understand this has something to do with SSLv3, but whatever I tried, nothing seems to fix the issue. And again I tried a lot of things that worked for other people having this issue.

I'm out of ideas and composer obviously is not really helpful in showing a clue to what's the problem here.

Is there anybody here that can help me with this, or give me some direction on where to look? This is taking a lot of time and effort last weeks without luck and I'd like to start building websites with Craft 3 using composer!! Thanks!

  • Try setting the cainfo property to the path to the latest .pem file. That's really the only thing I had to change: curl.cainfo="C:\dev\cacert\cacert.pem"
    – Brad Bell
    Commented Jun 11, 2018 at 18:56
  • Also, running any sort of anti-virus software on that box?
    – Brad Bell
    Commented Jun 11, 2018 at 18:58
  • Thanks for your response @BradBell, I had set curl.cainfo, but just checked it again. It's still set in php.ini and points to the right location of the certificate. Also checked the slashes. I disabled the firewall before, which didn't help. I also turned off full ESET protection, including anti-virus, but even then and in cmdline administrator mode composer diagnose still complains. Also curl extension is enabled. This thing is really starting to drive me insane. npm as well as yarn are running fine since day one without any problem, but not composer... Any more places to look?
    – Friksel
    Commented Jun 12, 2018 at 11:15
  • And I just verified the ca-file is valid for composer by running composer -vvv self-update... it says: Checked CA file C:\caCertificates\cacert.pem: valid. So really, if composer says it is installed correctly and it can find the right cacert.pem file which also labels it as valid.... what else can there be wrong that keeps composer complaining? It seems everything is in place to me...
    – Friksel
    Commented Jun 12, 2018 at 12:02
  • Hrm... running ESET here too and didn't have to make any changes to that. The main difference I see is that I'm using native IIS/MySQL installs... maybe some weird WAMP issue?
    – Brad Bell
    Commented Jun 12, 2018 at 23:31

1 Answer 1


Yes, after lots of trying I finally found the solution!! It was ESET causing the problem

Today, after re-installing PHP7 from scratch (so not using wamp and its contents anymore to make sure it's not wamp setup causing these problems) and reinstalling composer again I found that even that didn't work.

So I figured it really should be in some anti-virus or other blocking tool. And I only use ESET Internet Security.

But I tried disabling both ESET firewall as well as ESET anti-virus several times before and it didn't solve the mystery of the composer connectionproblems. So I took a closer look at ESET advanced settings more deeply now and it seems that eventhough I thought I turned everything in ESETs scans and blocks completely off (and that's exactly what ESET displays!), there happens to be a SSL-scan that wasn't turned off by that so still actively preventing composer to work.

I would say scanning SSL communication by ESET shouldn't cause any problems anyhow, just some milliseconds delay or whatever, but it obviously was completely blocking composer from reaching packagist through ssl. Turning off the SSL scan made composer reach packagist with https immediately, so finally this solves the mystery.

For people coming here with the same problem with composer and SSL and use ESET too, if you set up php and composer correctly then you should try this on ESET to solve the problem:

  • Enter ESET advanced setup (via rightclick menu on ESET icon)
  • Open up 'Web and email', and then the 'SSL/TLS' tab
  • Click the 'edit'-link after 'List of SSL/TLS filtered applications' (a dialog opens)
  • Check if the php.exe composer is using is in the list and if it does: make sure the scan action is set to 'ignore'. That prevents ESET from scanning the traffic via SSL from php.exe. Perhaps you could also add some certificate to the 'List of known certificates' here, but I solved it this way instead.
  • If php.exe is not in the list you should get a dialog window when running a composer command like 'composer diagnose' that needs ssl with packagist and ESET shows a dialog box for the new connection: set it to IGNORE. Scan will result in composer throwing warnings and having no connection with packagist.
  • If php.exe is not in the list and you don't get the ESET dialog window for the new connection when running 'composer diagnose' either you probably don't have the 'SSL/TLS protocol filtering mode' in ESET (under 'web and email'/SSL/TLS tab in advanced settings) set to interactive mode. Set it to interactive mode than.
  • If none of the above worked you could also choose to fully turn off all SSL/TLS protocol filtering in ESET by just switching it off in 'web and email' --> SSL/TLS --> Enable SSL/TLS protocol filtering. Then ESET isn't scanning any SSL anymore.

Hopefully this helps more people having the same issue.

Thisone really caused me headages for last weeks because it hold me back from switching to craft 3. So I'm really excited I finally got an answer to this now!! Finally it's time to move to the more important stuff!

  • WOW, that's some incredible debugging and thanks for the follow-up! Hopefully it'll help someone in the future as well.
    – Brad Bell
    Commented Jul 2, 2018 at 22:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.