fix(legacy): trust the certificates in the Windows certificate store

[pjcdawkins]

Fixes #110, where upsun login fails with cURL error 60 on a Windows machine whose TLS traffic is inspected.

Needs cli-php-builds#1, which built the PHP this depends on. That PHP is already released as php-8.4.23, so this works as it stands; #1 needs merging so the next build does not silently go back to Schannel.

The problem

For someone whose organization inspects TLS traffic, an extra root certificate is installed in the Windows certificate store, and every other program on the machine then trusts it.

The embedded PHP has to be given a CA file: its openssl extension cannot read that store, and the CLI uses openssl streams for some requests. curl built against Schannel then verifies against the given file alone — so the CLI trusted only the certificates shipped with it, and every request on such a machine failed.

The Go part of the CLI verifies through the Windows platform verifier, so it already trusted that certificate. The two parts of the CLI disagreed about the same connection.

The change

curl in the embedded PHP is now built against OpenSSL, which loads a CA file and the Windows stores together, and does not limit the size of the file. So:

• caBundle() reads the trusted roots from the store and appends those the shipped bundle does not already have, skipping expired certificates and any the Go parser cannot read.
• The wrapper writes that to cacert.pem and points openssl.cafile at it, as before. That setting covers the whole PHP layer, not just curl: Composer\CaBundle checks it, so Guzzle's verify option and the stream context in Config::getStreamContextOptions() use the same file.
• If the store cannot be read, the shipped certificates are still written and the reason goes to debug output. Reading the store happens in the errgroup which initializes the wrapper, so failing there would otherwise stop every legacy command — worse than not seeing an organization's certificates.
• openssl.cafile is now quoted. PHP parses ini values as expressions, so an unquoted path was truncated at a character such as ~, and a cache directory reached through a Windows short path gave cURL error 77 on every command. Backslashes are escaped too, since inside quotes a backslash escapes the next character.

This widens trust to what the machine already trusts, which is the point, and to what every other program on it trusts, Go included. It is additive: nothing previously trusted stops working.

Tests

internal/legacy/cert_store_windows_test.go and a windows-latest CI job, which is the only Windows coverage in the repository. The test installs a throwaway CA in the machine's root store, serves HTTPS with a certificate signed by it, and makes requests with the embedded PHP binary. Measured on the runner:

PHP configuration	result
no CA file	OK:hello — the store is used
the settings the wrapper passes	OK:hello — this is the fix; it was cURL error 60
only the shipped certificates	ERR:60: OpenSSL verify result: self-signed certificate in certificate chain
the bundle the wrapper generates	holds the installed certificate

The bundle came to 474 certificates in 768 KB. TestWindowsIniSetting separately checks that PHP reads a cache path, a Windows short path and a network path back unchanged.

The test modifies the machine's certificate store, so it needs administrator rights and only runs when CLI_TEST_MODIFY_CERT_STORE=1; otherwise it skips. It removes the certificate in t.Cleanup. Adding to the user's store instead makes Windows ask for confirmation and the call never returns, so the add has a 30 second deadline.

What was tried first

Merging the whole store while keeping Schannel. The runner rejected it: Schannel refuses a CA file over 1 MiB (MAX_CAFILE_SIZE in curl's schannel_verify.c), and a 564-root store gave a 758 KB bundle even after filtering — 76% of a hard limit, with a silent fallback to shipped-only above it. Switching the backend removed the limit, and with it the filtering heuristics and the fallback.

Cost

Reading the store happens before every legacy command. Measured on the runner:

BenchmarkWindowsCABundle-4   56   20996850 ns/op   5908247 B/op   35259 allocs/op
BenchmarkWindowsCAFile-4     62   19474245 ns/op   5942163 B/op   35267 allocs/op

About 20 ms, nearly all of it reading and parsing certificates; the file comparison and write are free. Not cached deliberately: a cache would mean the CLI keeps rejecting a certificate the machine already trusts until it expired, which is this bug with a delay. The allocation count says the number belongs to the implementation rather than the store, so making it leaner is the first move if it ever matters.

PHP 8.4.23

Taken for the OpenSSL-backed curl this depends on. It also brings security fixes since 8.4.20, two of which apply here: CVE-2026-12184, a segfault in file_get_contents with an https URL and a proxy set, a combination the CLI uses; and CVE-2026-14355 in the openssl extension.

Written by Claude Code.

[upsun-dispatch]

📋 PR Summary

This incremental change makes the Windows CA bundle logic degrade gracefully instead of aborting the CLI. caBundle() now returns the shipped caCert (plus the error) when the certificate store cannot be read, and writeCAFile() records the failure as a non-fatal warning while still writing the shipped bundle. The warnings are surfaced through a new warnings() method on the phpManager interface and logged at debug level after init completes.

Changes

Layer / File(s)	Summary
graceful store-read fallback
internal/legacy/ca_bundle_windows.go	On a store-read error, caBundle() now returns the embedded caCert alongside the error instead of a nil bundle, and documents the ROOT store merge and fallback behavior.
internal/legacy/php_manager_windows.go	writeCAFile() no longer returns the caBundle() error; it appends the reason to copyWarnings and still writes the (shipped) bundle so init cannot fail on a store-read error.
warnings plumbing
internal/legacy/php_manager.go	Adds a warnings() method to the phpManager interface and a copyWarnings field to phpManagerPerOS; switches to keyed struct construction.
internal/legacy/legacy.go	Holds the phpManager so its warnings can be emitted via c.debug after g.Wait() succeeds.
tests
internal/legacy/ca_bundle_windows_test.go	Updates the benchmark to keyed struct construction to match the new field.

[pjcdawkins]

Both review findings addressed.

The store-read failure warning was right and is the more important of the two: copy() runs in the errgroup which initializes the wrapper, so a failure to read the store would have stopped every legacy command — strictly worse than not seeing an organization certificate. caBundle() now returns the shipped certificates along with the reason, writeCAFile writes them and records the reason, and the wrapper reports it through debug. So a locked-down environment loses the store, not the CLI.

On widening trust to user-installed roots: that is deliberate, and it is the point of the change. The ROOT store is what the operating system trusts, and it is what the Go part of this same CLI already trusted through the platform verifier — so before this change the two halves disagreed about the same connection. Filtering to CA:true would drop legitimate corporate roots, which often lack basic constraints, in exchange for a threat model where a user who can write to their own HKCU\ROOT has already compromised every browser and tool on the machine. I have added a comment saying the store merges the machine and user roots, so the next reader does not have to infer it.

Written by Claude Code.

[upsun-dispatch]

📋 Upsun Dispatch Review: incremental · 5 files reviewed · no new issues · 1 still open

Outstanding from earlier reviews:

• #3679219852 — internal/legacy/ca_bundle_windows.go:56: Widens PHP trust to user-installed roots and unconstrained certs in the ROOT store.