phalcon/cphalcon · critical · MissingOpensslExtension

This class requires the openssl extension for PHP

Error message

This class requires the openssl extension for PHP

What it means

Crypt's constructor path (initializeAvailableCiphers) checks function_exists('openssl_get_cipher_methods'); if the openssl extension is not loaded it throws MissingOpensslExtension('This class requires the openssl extension for PHP'). Every Crypt operation needs OpenSSL for ciphers, IVs, and random bytes, so the class refuses to construct.

Source

Thrown at phalcon/Encryption/Crypt.zep:946

         * Store the tag with encrypted data and return it. In the non AEAD
         * mode this is an empty string
         */
        return encrypted . authTag;
    }

    /**
     * Initialize available cipher algorithms.
     *
     * @return static
     * @throws Exception
     */
    protected function initializeAvailableCiphers() -> <static>
    {
        var available, cipher;
        array allowed;

        if true !== this->phpFunctionExists("openssl_get_cipher_methods") {
            throw new MissingOpensslExtension();
        }

        let available = openssl_get_cipher_methods(true),
            allowed   = [];

        for cipher in available {
            if (
                true !== starts_with(cipher, "des") &&
                true !== starts_with(cipher, "rc2") &&
                true !== starts_with(cipher, "rc4") &&
                true !== ends_with(cipher, "ecb")
            ) {
                let allowed[cipher] = cipher;
            }
        }

        let this->availableCiphers = allowed;

View on GitHub (pinned to b7419de9cd)

Solutions

1. Install/enable the extension: apt-get install php-openssl (Debian), apk add php8-openssl (Alpine), then restart php-fpm/CLI; on Windows uncomment extension=openssl in php.ini and ensure libcrypto/libssl DLLs are reachable.
2. Verify with php -m | grep openssl and function_exists('openssl_get_cipher_methods') in the exact runtime (CLI vs fpm can load different ini files).
3. Pin CI/deploy images so openssl presence is guaranteed, and add a boot requirement check so absence fails loudly at deploy rather than at first Crypt use.

Example fix

# before: container lacks the extension
# Fatal: Phalcon\Encryption\Crypt\Exception\MissingOpensslExtension

# after (Dockerfile)
RUN apt-get update && apt-get install -y php8.3-openssl && docker-php-ext-enable openssl

# verify
RUN php -r 'exit(function_exists("openssl_get_cipher_methods") ? 0 : 1);'

if (!extension_loaded('openssl') || !function_exists('openssl_get_cipher_methods')) {
    throw new \RuntimeException('The openssl PHP extension is required by Phalcon\Encryption\Crypt');
}
$crypt = new \Phalcon\Encryption\Crypt();

function opensslAvailable(): bool
{
    return extension_loaded('openssl') && function_exists('openssl_get_cipher_methods');
}

try {
    $crypt = new \Phalcon\Encryption\Crypt();
} catch (\Phalcon\Encryption\Crypt\Exception\MissingOpensslExtension $e) {
    // deployment error - abort with an actionable message for ops
    throw new \RuntimeException('php-openssl missing: install/enable the extension and restart php-fpm', 0, $e);
}

When it happens

Trigger: new Crypt() (or resolving 'crypt' from the DI container, since Phalcon registers it by default) on a PHP runtime compiled/loaded without the openssl extension - typical for minimal Docker images, stripped-down shared hosts, or CLI binaries built with --disable-openssl... effectively any runtime where ext-openssl is absent.

Common situations: CI pipelines using slim PHP images (php:8.x-alpine without openssl); production containers built from scratch/distroless missing php-openssl; local installs where the extension line was commented out of php.ini; Windows php.ini without extension=openssl.

Related errors

• Cannot calculate Random Pseudo Bytes
• The {} algorithm '{}' is not supported on this system.
• Yaml extension is not loaded
• Could not decrypt data
• Could not encrypt data

AI-assisted analysis of phalcon/cphalcon@b7419de9cd (2026-08-21). Data as JSON: /api/errors/0fc1809b165296ee. Report an issue: GitHub.