fix(legacy): trust the certificates in the Windows certificate store

[pjcdawkins]

Fixes#110, where upsun login fails with cURL error 60 on a Windows machine whose TLS traffic is inspected.

Needs cli-php-builds#1, which built the PHP this depends on. That PHP is already released as php-8.4.23, so this works as it stands; cli-php-builds#1 needs merging so the next build does not silently go back to Schannel.

The problem

For someone whose organization inspects TLS traffic, an extra root certificate is installed in the Windows certificate store, and every other program on the machine then trusts it.

The embedded PHP has to be given a CA file: its openssl extension cannot read that store, and the CLI uses openssl streams for some requests. curl built against Schannel then verifies against the given file alone — so the CLI trusted only the certificates shipped with it, and every request on such a machine failed.

The Go part of the CLI verifies through the Windows platform verifier, so it already trusted that certificate. The two parts of the CLI disagreed about the same connection.

The change

curl in the embedded PHP is now built against OpenSSL, which loads a CA file and the Windows stores together, and does not limit the size of the file. So:

• caBundle() reads the trusted roots from the store and appends those the shipped bundle does not already have, skipping expired certificates and any the Go parser cannot read.
• The wrapper writes that to cacert.pem and points openssl.cafile at it, as before. That setting covers the whole PHP layer, not just curl: Composer\CaBundle checks it, so Guzzle's verify option and the stream context in Config::getStreamContextOptions() use the same file.
• If the store cannot be read, the shipped certificates are still written and the reason goes to debug output. Reading the store happens in the errgroup which initializes the wrapper, so failing there would otherwise stop every legacy command — worse than not seeing an organization's certificates.
• openssl.cafile is now quoted. PHP parses ini values as expressions, so an unquoted path was truncated at a character such as ~, and a cache directory reached through a Windows short path gave cURL error 77 on every command. Backslashes are escaped too, since inside quotes a backslash escapes the next character.

This widens trust to what the machine already trusts, which is the point, and to what every other program on it trusts, Go included. It is additive: nothing previously trusted stops working.

Tests

internal/legacy/cert_store_windows_test.go and a windows-latest CI job, which is the only Windows coverage in the repository. The test installs a throwaway CA in the machine's root store, serves HTTPS with a certificate signed by it, and makes requests with the embedded PHP binary. Measured on the runner:

PHP configuration	result
no CA file	OK:hello — the store is used
the settings the wrapper passes	OK:hello — this is the fix; it was cURL error 60
only the shipped certificates	ERR:60: OpenSSL verify result: self-signed certificate in certificate chain
the bundle the wrapper generates	holds the installed certificate

The bundle came to 474 certificates in 768 KB. TestWindowsIniSetting separately checks that PHP reads a cache path, a Windows short path and a network path back unchanged.

The test modifies the machine's certificate store, so it needs administrator rights and only runs when CLI_TEST_MODIFY_CERT_STORE=1; otherwise it skips. It removes the certificate in t.Cleanup. Adding to the user's store instead makes Windows ask for confirmation and the call never returns, so the add has a 30 second deadline.

What was tried first

Merging the whole store while keeping Schannel. The runner rejected it: Schannel refuses a CA file over 1 MiB (MAX_CAFILE_SIZE in curl's schannel_verify.c), and a 564-root store gave a 758 KB bundle even after filtering — 76% of a hard limit, with a silent fallback to shipped-only above it. Switching the backend removed the limit, and with it the filtering heuristics and the fallback.

Cost

Reading the store happens before every legacy command. Measured on the runner:

BenchmarkWindowsCABundle-4 56 20996850 ns/op 5908247 B/op 35259 allocs/op
BenchmarkWindowsCAFile-4 62 19474245 ns/op 5942163 B/op 35267 allocs/op

About 20 ms, nearly all of it reading and parsing certificates; the file comparison and write are free. Not cached deliberately: a cache would mean the CLI keeps rejecting a certificate the machine already trusts until it expired, which is this bug with a delay. The allocation count says the number belongs to the implementation rather than the store, so making it leaner is the first move if it ever matters.

PHP 8.4.23

Taken for the OpenSSL-backed curl this depends on. It also brings security fixes since 8.4.20, two of which apply here: CVE-2026-12184, a segfault in file_get_contents with an https URL and a proxy set, a combination the CLI uses; and CVE-2026-14355 in the openssl extension.

Written by Claude Code.

[upsun-dispatch]

📋 PR Summary

This incremental change touches only internal/legacy/cert_store_windows_test.go: it rewrites the file-level comment to describe the new OpenSSL-backed curl behavior (CA file plus the Windows stores loaded together) instead of the old Schannel behavior, and removes the now-unused openRootStore test helper. The comment update is factually consistent with the PR's design, and the deleted helper has no remaining references.

Changes

Layer / File(s)	Summary
windows cert-store tests
internal/legacy/cert_store_windows_test.go	Updated the file-level comment to reflect curl being built against OpenSSL (CA file + Windows stores loaded together) and removed the unused openRootStore helper.

[pjcdawkins]

Both review findings addressed.

The store-read failure warning was right and is the more important of the two: copy() runs in the errgroup which initializes the wrapper, so a failure to read the store would have stopped every legacy command — strictly worse than not seeing an organization certificate. caBundle() now returns the shipped certificates along with the reason, writeCAFile writes them and records the reason, and the wrapper reports it through debug. So a locked-down environment loses the store, not the CLI.

On widening trust to user-installed roots: that is deliberate, and it is the point of the change. The ROOT store is what the operating system trusts, and it is what the Go part of this same CLI already trusted through the platform verifier — so before this change the two halves disagreed about the same connection. Filtering to CA:true would drop legitimate corporate roots, which often lack basic constraints, in exchange for a threat model where a user who can write to their own HKCU\ROOT has already compromised every browser and tool on the machine. I have added a comment saying the store merges the machine and user roots, so the next reader does not have to infer it.

Written by Claude Code.

[upsun-dispatch]

📋 Upsun Dispatch Review: incremental · 5 files reviewed · no new issues · 1 still open

Outstanding from earlier reviews:

• #3679219852 — internal/legacy/ca_bundle_windows.go:56: Widens PHP trust to user-installed roots and unconstrained certs in the ROOT store.

[bojanz]

What's here looks good. I found two possible hardenings but I will open followup PRs for them so that they can be discussed without blocking the main work.

[Copilot]

Pull request overview

This pull request updates the embedded Windows PHP runtime and the legacy wrapper so that TLS verification in the PHP layer aligns with what Windows (and the Go layer) already trusts, addressing cURL error 60 failures on corporate TLS-inspection networks.

Changes:

• Bump embedded PHP to 8.4.23 (required for the OpenSSL-backed curl behavior this fix relies on).
• On Windows, generate and write a CA bundle that combines the shipped bundle with trusted roots from the Windows certificate store, and pass openssl.cafile via properly quoted/escaped -d settings.
• Add Windows-only tests and a dedicated windows-latest CI job that validates trust behavior end-to-end with the embedded PHP binary.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
Makefile	Updates embedded PHP version to 8.4.23.
internal/legacy/php_manager.go	Extends php manager interface to surface non-fatal copy warnings.
internal/legacy/php_manager_windows.go	Writes a generated CA file on Windows and quotes/escapes ini -d settings.
internal/legacy/php_manager_windows_test.go	Adds a Windows test ensuring ini -d path quoting/escaping round-trips in PHP.
internal/legacy/legacy.go	Emits non-fatal PHP manager warnings during wrapper initialization.
internal/legacy/ca_bundle_windows.go	Implements Windows store reading and additive CA bundle construction.
internal/legacy/ca_bundle_windows_test.go	Validates bundle composition/readability and benchmarks bundle generation.
internal/legacy/cert_store_windows_test.go	Adds an end-to-end Windows trust test using a throwaway CA installed in the root store.
.github/workflows/ci.yml	Adds a Windows CI job to run the new Windows trust tests and benchmarks.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[upsun-dispatch]

Note

Reviewed — No new blocking findings · 3 minor points

🔍 Full review · 9 files reviewed

🔵 Minor points

Not blocking, and no threads opened for these.

• internal/legacy/cert_store_windows_test.go:260 — openRootStore is defined but never called anywhere in the package — only openMachineRootStore is used. Because it lives in a _windows_test.go file, the ubuntu golangci-lint job never compiles or analyzes it, so the unused function will not be flagged automatically.
• internal/legacy/cert_store_windows_test.go:178 — testCA.certPEM is populated here via pem.EncodeToMemory but never read by any test; only certDER and serverCert are consumed. The PEM encoding is computed and carried for no consumer.
• internal/legacy/ca_bundle_windows_test.go:26 — assert.Greater(len(held), len(shipped)) assumes the CI runner's ROOT store contains at least one currently-valid certificate not already in the shipped Mozilla bundle. On a runner whose store roots are all already shipped, expired, or unparseable, held == shipped and the test fails even though caBundle behaved correctly.

Review details

• Commit:fd7ec8f
• Model: claude-opus-4-8
• Panel: security · correctness · robustness · design