phacility/phabricator · error · Exception

The PHP 'openssl' extension is not installed. You must insta

Error message

The PHP 'openssl' extension is not installed. You must install this extension in order to add a JIRA authentication provider, because JIRA OAuth requests use the RSA-SHA1 signing algorithm. Install the 'openssl' extension, restart everything, and try again.

What it means

Thrown from PhabricatorJIRAAuthProvider::extendEditForm() when the administrator opens the provider's edit/create form and the PHP openssl extension is not loaded (probed via function_exists('openssl_pkey_new')). JIRA's OAuth uses RSA-SHA1 signing, which requires openssl to generate and handle the keypair, so the form refuses to render rather than failing later at signing time. It is an environment-check Exception aimed at the operator, with explicit remediation text.

Source

Thrown at src/applications/auth/provider/PhabricatorJIRAAuthProvider.php:169

      list($public, $private) = PhutilJIRAAuthAdapter::newJIRAKeypair();

      $config->setProperty(self::PROPERTY_PUBLIC_KEY, $public);
      $config->setProperty(self::PROPERTY_PRIVATE_KEY, $private);
      $config->setProperty(self::PROPERTY_CONSUMER_KEY, $consumer_key);
    }

    return array($errors, $issues, $values);
  }

  public function extendEditForm(
    AphrontRequest $request,
    AphrontFormView $form,
    array $values,
    array $issues) {

    if (!function_exists('openssl_pkey_new')) {
      // TODO: This could be a bit prettier.
      throw new Exception(
        pht(
          "The PHP 'openssl' extension is not installed. You must install ".
          "this extension in order to add a JIRA authentication provider, ".
          "because JIRA OAuth requests use the RSA-SHA1 signing algorithm. ".
          "Install the 'openssl' extension, restart everything, and try ".
          "again."));
    }

    $form->appendRemarkupInstructions(
      pht(
        'NOTE: This provider **only supports JIRA 6**. It will not work with '.
        'JIRA 5 or earlier.'));

    $is_setup = $this->isSetup();
    $viewer = $request->getViewer();

    $e_required = $request->isFormPost() ? null : true;

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Install the openssl PHP extension for the PHP build the web server actually runs (e.g. `apt-get install php-openssl` / `yum install php-openssl`, or enable it in the Docker image), ensuring the correct version-suffixed package.
2. Enable it in php.ini (`extension=openssl`) for both web and CLI SAPIs, then fully restart php-fpm/Apache and any daemons ('restart everything').
3. Verify with `php -m | grep openssl` and a phpinfo() page served through the web SAPI before retrying.
4. If openssl cannot be installed on that host, configure the JIRA provider from a host that has it, or do not use the JIRA provider (it cannot sign RSA-SHA1 without openssl).

// Gate the JIRA provider on the extension before rendering its config UI
if (!function_exists('openssl_pkey_new')) {
  // render 'openssl extension required' guidance instead of the edit form
}

When it happens

Trigger: Adding or editing a JIRA authentication provider in the Auth admin UI on a host where PHP lacks the openssl extension — e.g. the CLI/web SAPI in use was built without openssl, a different php.ini is loaded for the web server than the one checked at deploy time, or the extension was disabled in a hardened PHP config.

Common situations: Minimal container images (php-fpm:alpine style) shipping without openssl; distro PHP split into many extension packages where php-openssl was never installed; php.ini updated during a PHP upgrade and extension=openssl commented out; CLI has openssl but the web SAPI does not (or vice versa).

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Before you can set up or use LDAP, you need to install the P
• No JIRA provider configured.
• Failed to openssl_decrypt() data: %s
• Keyring is configured with a "%s" key, but the PHP OpenSSL e
• Service "%s" is unrecognized, restricted, or you do not have

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/ee104bea107a8ca4. Report an issue: GitHub.