{"record":{"id":"47e2edf73d3f07ee","repo":"phalcon/cphalcon","slug":"the-algorithm-is-not-supported-on-this-sys","errorCode":null,"errorMessage":"The {} algorithm '{}' is not supported on this system.","messagePattern":"The (.+?) algorithm '(.+?)' is not supported on this system\\.","errorType":"exception","errorClass":"UnsupportedAlgorithm","httpStatus":null,"severity":"error","filePath":"phalcon/Encryption/Crypt.zep","lineNumber":663,"sourceCode":"     * @param string $cipher\n     * @param string $type\n     *\n     * @throws Exception\n     */\n    protected function checkCipherHashIsAvailable(string cipher, string type) -> void\n    {\n        var available, lower, method;\n\n        if \"hash\" === type {\n            let method = \"getAvailableHashAlgorithms\";\n        } else {\n            let method = \"getAvailableCiphers\";\n        }\n\n        let available = this->{method}(),\n            lower     = mb_strtolower(cipher);\n        if true !== in_array(lower, available) {\n            throw new UnsupportedAlgorithm(type, cipher);\n        }\n    }\n\n    /**\n     * Pads texts before encryption. See\n     * [cryptopad](https://www.di-mgt.com.au/cryptopad.html)\n     *\n     * @param string $input\n     * @param string $mode\n     * @param int    $blockSize\n     * @param int    $paddingType\n     *\n     * @return string\n     * @throws Exception\n     */\n    protected function cryptPadText(\n        string input,\n        string mode,","sourceCodeStart":645,"sourceCodeEnd":681,"githubUrl":"https://github.com/phalcon/cphalcon/blob/b7419de9cd0a8a3f48441ead84c9f8415d463e25/phalcon/Encryption/Crypt.zep#L645-L681","documentation":"Crypt::setCipher() and the hash-algorithm equivalents route through checkCipherHashIsAvailable(): it fetches the system's available list (openssl_get_cipher_methods(true) for ciphers, getAvailableHashAlgorithms for hashes), lowercases the requested name, and throws UnsupportedAlgorithm('The {type} algorithm \"{name}\" is not supported on this system.') if it is absent. The check runs at set time so an unusable cipher fails immediately, not on first encrypt.","triggerScenarios":"setCipher('aes-256-gcm') on an OpenSSL build without GCM (some older distro builds, certain FIPS builds); setCipher('camellia-256-cbc') where libssl lacks camellia; a hash algorithm string not in hash_algos(); or a typo/mixed-case name that is otherwise fine ('AES-256-CBC' works since it is lowercased before comparison).","commonSituations":"Deploying to a different OS/base image (Debian -> Alpine, older CentOS) whose OpenSSL lacks the cipher; local dev on macOS with a richer OpenSSL than production; PHP linked against a minimal openssl; requiring gcm while the shared host's libssl predates it.","solutions":["List what the target system supports: php -r 'print_r(openssl_get_cipher_methods(true));' and pick from that.","Standardize on aes-256-cbc or aes-256-gcm (gcm only where confirmed available) across environments.","If a specific algorithm is mandatory, provision the runtime so OpenSSL supports it (newer libssl, correct php-openssl build) and pin base images so dev/prod match.","Never hardcode an unverified cipher from a tutorial - resolve it from config validated at boot against the available list."],"exampleFix":"// before\n$crypt->setCipher('aes-256-ocb'); // not in openssl_get_cipher_methods on this host\n\n// after\n$cipher = 'aes-256-gcm';\nif (!in_array($cipher, openssl_get_cipher_methods(true), true)) {\n    $cipher = 'aes-256-cbc';\n}\n$crypt->setCipher($cipher);","handlingStrategy":"validation","validationCode":"$cipher = $config->path('encryption.cipher');\nif (!in_array(mb_strtolower($cipher), array_map('mb_strtolower', openssl_get_cipher_methods(true)), true)) {\n    throw new \\RuntimeException(\"Cipher '{$cipher}' not supported by this system's OpenSSL\");\n}\n$crypt->setCipher($cipher);","typeGuard":"function isCipherSupportedOnThisSystem(string $cipher): bool\n{\n    return in_array(mb_strtolower($cipher), openssl_get_cipher_methods(true), true);\n}","tryCatchPattern":"try {\n    $crypt->setCipher($desired);\n} catch (\\Phalcon\\Encryption\\Crypt\\Exception\\UnsupportedAlgorithm $e) {\n    $crypt->setCipher('aes-256-cbc'); // negotiated fallback, log the difference\n    $logger->warning($e->getMessage() . ' - falling back to aes-256-cbc');\n}","preventionTips":["Pin identical base images for dev/CI/prod so OpenSSL capabilities match.","Smoke-test the chosen cipher in CI with openssl_get_cipher_methods before deploy.","Store the cipher name next to the ciphertext so decrypting old records after a migration uses the right algorithm."],"tags":["phalcon","crypt","openssl","cipher","algorithm-support","environment"],"backgroundTag":"unsupported-cipher-algorithm","analyzedSha":"b7419de9cd0a8a3f48441ead84c9f8415d463e25","analyzedAt":"2026-08-21T06:21:18.811Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}