{"record":{"id":"ee104bea107a8ca4","repo":"phacility/phabricator","slug":"the-php-openssl-extension-is-not-installed-you","errorCode":null,"errorMessage":"The PHP 'openssl' extension is not installed. You must install this extension in order to add a JIRA authentication provider, because JIRA OAuth requests use the RSA-SHA1 signing algorithm. Install the 'openssl' extension, restart everything, and try again.","messagePattern":"The PHP 'openssl' extension is not installed\\. You must install this extension in order to add a JIRA authentication provider, because JIRA OAuth requests use the RSA-SHA1 signing algorithm\\. Install the 'openssl' extension, restart everything, and try again\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/auth/provider/PhabricatorJIRAAuthProvider.php","lineNumber":169,"sourceCode":"      list($public, $private) = PhutilJIRAAuthAdapter::newJIRAKeypair();\n\n      $config->setProperty(self::PROPERTY_PUBLIC_KEY, $public);\n      $config->setProperty(self::PROPERTY_PRIVATE_KEY, $private);\n      $config->setProperty(self::PROPERTY_CONSUMER_KEY, $consumer_key);\n    }\n\n    return array($errors, $issues, $values);\n  }\n\n  public function extendEditForm(\n    AphrontRequest $request,\n    AphrontFormView $form,\n    array $values,\n    array $issues) {\n\n    if (!function_exists('openssl_pkey_new')) {\n      // TODO: This could be a bit prettier.\n      throw new Exception(\n        pht(\n          \"The PHP 'openssl' extension is not installed. You must install \".\n          \"this extension in order to add a JIRA authentication provider, \".\n          \"because JIRA OAuth requests use the RSA-SHA1 signing algorithm. \".\n          \"Install the 'openssl' extension, restart everything, and try \".\n          \"again.\"));\n    }\n\n    $form->appendRemarkupInstructions(\n      pht(\n        'NOTE: This provider **only supports JIRA 6**. It will not work with '.\n        'JIRA 5 or earlier.'));\n\n    $is_setup = $this->isSetup();\n    $viewer = $request->getViewer();\n\n    $e_required = $request->isFormPost() ? null : true;\n","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/auth/provider/PhabricatorJIRAAuthProvider.php#L151-L187","documentation":"Thrown from PhabricatorJIRAAuthProvider::extendEditForm() when the administrator opens the provider's edit/create form and the PHP openssl extension is not loaded (probed via function_exists('openssl_pkey_new')). JIRA's OAuth uses RSA-SHA1 signing, which requires openssl to generate and handle the keypair, so the form refuses to render rather than failing later at signing time. It is an environment-check Exception aimed at the operator, with explicit remediation text.","triggerScenarios":"Adding or editing a JIRA authentication provider in the Auth admin UI on a host where PHP lacks the openssl extension — e.g. the CLI/web SAPI in use was built without openssl, a different php.ini is loaded for the web server than the one checked at deploy time, or the extension was disabled in a hardened PHP config.","commonSituations":"Minimal container images (php-fpm:alpine style) shipping without openssl; distro PHP split into many extension packages where php-openssl was never installed; php.ini updated during a PHP upgrade and extension=openssl commented out; CLI has openssl but the web SAPI does not (or vice versa).","solutions":["Install the openssl PHP extension for the PHP build the web server actually runs (e.g. `apt-get install php-openssl` / `yum install php-openssl`, or enable it in the Docker image), ensuring the correct version-suffixed package.","Enable it in php.ini (`extension=openssl`) for both web and CLI SAPIs, then fully restart php-fpm/Apache and any daemons ('restart everything').","Verify with `php -m | grep openssl` and a phpinfo() page served through the web SAPI before retrying.","If openssl cannot be installed on that host, configure the JIRA provider from a host that has it, or do not use the JIRA provider (it cannot sign RSA-SHA1 without openssl)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Gate the JIRA provider on the extension before rendering its config UI\nif (!function_exists('openssl_pkey_new')) {\n  // render 'openssl extension required' guidance instead of the edit form\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Bake required PHP extensions (openssl, ldap) into deployment images and verify at boot with `php -m`.","Include extension checks in smoke tests after PHP upgrades or php.ini changes.","Remember web and CLI SAPIs load different php.ini files — verify through the web SAPI too."],"tags":["phabricator","jira","php","openssl","missing-extension","oauth"],"backgroundTag":"missing-php-extension","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}