<p><strong>Yes, after lots of trying I finally found the solution!! It was ESET causing the problem</strong></p>

<p>Today, after re-installing PHP7 from scratch (so not using wamp and its contents anymore to make sure it's not wamp setup causing these problems) and reinstalling composer again I found that even that didn't work.</p>

<p>So I figured it really should be in some anti-virus or other blocking tool. And I only use ESET Internet Security. </p>

<p>But I tried disabling both ESET firewall as well as ESET anti-virus several times before and it didn't solve the mystery of the composer connectionproblems.
So I took a closer look at ESET advanced settings more deeply now and it seems that eventhough I thought I turned everything in ESETs scans and blocks completely off (and that's exactly what ESET displays!), there happens to be a SSL-scan that wasn't turned off by that so still actively preventing composer to work.</p>

<p>I would say scanning SSL communication by ESET shouldn't cause any problems anyhow, just some milliseconds delay or whatever, but it obviously was completely blocking composer from reaching packagist through ssl. Turning off the SSL scan made composer reach packagist with https immediately, so finally this solves the mystery.</p>

<p>For people coming here with the same problem with composer and SSL and use ESET too, if you set up php and composer correctly then you should try this on ESET to solve the problem:</p>

<ul>
<li>Enter ESET advanced setup (via rightclick menu on ESET icon)</li>
<li>Open up 'Web and email', and then the 'SSL/TLS' tab</li>
<li>Click the 'edit'-link after 'List of SSL/TLS filtered applications' (a dialog opens)</li>
<li>Check if the php.exe composer is using is in the list and if it does: make sure the scan action is set to 'ignore'. That prevents ESET from scanning the traffic via SSL from php.exe. Perhaps you could also add some certificate to the 'List of known certificates' here, but I solved it this way instead.</li>
<li>If php.exe is not in the list you should get a dialog window when running
a composer command like 'composer diagnose' that needs ssl with packagist and ESET shows a dialog box for the new connection: set it to IGNORE. Scan will result in composer throwing warnings and having no connection with packagist.</li>
<li>If php.exe is not in the list and you don't get the ESET dialog window for the new connection when running 'composer diagnose' either you probably don't have the 'SSL/TLS protocol filtering mode' in ESET (under 'web and email'/SSL/TLS tab in advanced settings) set to interactive mode. Set it to interactive mode than.</li>
<li>If none of the above worked you could also choose to fully turn off all SSL/TLS protocol filtering in ESET by just switching it off in 'web and email' --> SSL/TLS --> Enable SSL/TLS protocol filtering. Then ESET isn't scanning any SSL anymore.</li>
</ul>

<p>Hopefully this helps more people having the same issue.</p>

<p>Thisone really caused me headages for last weeks because it hold me back from switching to craft 3. So I'm really excited I finally got an answer to this now!! Finally it's time to move to the more important stuff!</p>

CC BY-SA 4.0
2018-07-02T22:57:46.523Z
WOW, that's some incredible debugging and thanks for the follow-up! Hopefully it'll help someone in the future as well.
Brad Bell
CC BY-SA 4.0
2018-06-30T18:47:29.580Z
2018-06-30T18:47:29.580Z
Friksel
<p>for last weeks really I try to install composer, but it keeps complaining about SSL-problems. I searched everywhere on Google and found lots of people having the same problems, but for some reason they found solutions which don't work here. </p>

<p>I really need to install composer, 'cause I like to use Craft 3, but whatever I try, it's not working. There is no composer-forum, and I guess all you guys needed to use composer to install Craft 3 too, so I hope somebody here can help. I'm really out of ideas at the moment...</p>

<p>I tried this:</p>

<p><strong>SETUP VIA WINDOWS INSTALLER</strong></p>

<ul>
<li>Download and run windows installer Composer 1.6.5: <a href="https://getcomposer.org/download/" rel="nofollow noreferrer">https://getcomposer.org/download/</a> 
I see the path is pointing to the right php.exe (and the same php I use on wamp server). I don't use a proxy.</li>
<li>Running <code>composer</code> after install shows me composer is installed.</li>
<li>Running <code>composer diagnose</code> however shows me a <code>WARNING</code> after <code>https connectivity to packagist</code>: <strong>The <a href="https://packagist.org/packages.json" rel="nofollow noreferrer">https://packagist.org/packages.json</a> file could not be downloaded: SSL operation failed with code 1.</strong></li>
<li>So in php I checked if php_openssl is enabled and it is.</li>
<li>I also have this in my <code>php.ini</code> file, pointing to a cacert.pem certificate, downloaded from <a href="http://curl.haxx.se/ca/cacert.pem" rel="nofollow noreferrer">http://curl.haxx.se/ca/cacert.pem</a> :
<code>openssl.cafile="C:\caCertificates\cacert.pem"
openssl.capath="C:\caCertificates\"</code></li>
<li>Running <code>php --ini</code> on cmdline I verified it's definitely the edited <code>php.ini</code> file that is active on command line/composer use (C:\wamp64\bin\php\php7.1.16)</li>
<li>I turned firewall off </li>
<li>I even uninstalled wamp-server with all php-stuff and installed a complete fresh, updated, install of Wamp server (3.1.3 64b)</li>
<li>But <code>composer diagnose</code> keeps throwing the warning, and composer is not working.</li>
</ul>

<p><strong>SETUP VIA PHP INSTALLER</strong><br/>
Than I tried the php-install script I found on getcomposer.org and run this from command line:<br/>
<code>php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
php -r "if (hash_file('SHA384', 'composer-setup.php') === '544e09ee996cdf60ece3804abc52599c22b1f40f4323403c44d44fdfdd586475ca9813a858088ffbc1f233e9b180f061') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
php composer-setup.php
php -r "unlink('composer-setup.php');"</code><br>
 - It returns with:<br/>
<code>Installer verified. All settings correct for using Composer. Downloading...
Composer (version 1.6.5) successfully installed to: C:\proj-folder\test\composer.phar</code><Br/>
 - But when I run <code>composer diagnose</code> in that test-folder it's still throwing the warning.</p>

<p>BTW I tried above with administrative rights too.</p>

<p>I understand this has something to do with SSLv3, but whatever I tried, nothing seems to fix the issue. And again I tried a lot of things that worked for other people having this issue.</p>

<p>I'm out of ideas and composer obviously is not really helpful in showing a clue to what's the problem here. </p>

<p>Is there anybody here that can help me with this, or give me some direction on where to look? This is taking a lot of time and effort last weeks without luck and I'd like to start building websites with Craft 3 using composer!! Thanks!</p>

CC BY-SA 4.0
2018-06-11T18:56:59.893Z
Try setting the `cainfo` property to the path to the latest .pem file. That's really the only thing I had to change: `curl.cainfo="C:\dev\cacert\cacert.pem"`
Brad Bell
CC BY-SA 4.0
2018-06-11T18:58:42.330Z
Also, running any sort of anti-virus software on that box?
Brad Bell
CC BY-SA 4.0
2018-06-12T11:15:35.183Z
Thanks for your response @BradBell, I had set `curl.cainfo`, but just checked it again. It's still set in php.ini and points to the right location of the certificate. Also checked the slashes. I disabled the firewall before, which didn't help. I also turned off full ESET protection, including anti-virus, but even then and in cmdline administrator mode `composer diagnose` still complains. Also curl extension is enabled.

This thing is really starting to drive me insane. npm as well as yarn are running fine since day one without any problem, but not composer... Any more places to look?
Friksel
CC BY-SA 4.0
2018-06-12T12:02:35.160Z
And I just verified the ca-file is valid for composer by running `composer -vvv self-update`... it says: `Checked CA file C:\caCertificates\cacert.pem: valid`. So really, if composer says it is installed correctly and it can find the right cacert.pem file which also labels it as valid.... what else can there be wrong that keeps composer complaining? It seems everything is in place to me...
Friksel
CC BY-SA 4.0
2018-06-12T23:31:27.387Z
Hrm... running ESET here too and didn't have to make any changes to that. The main difference I see is that I'm using native IIS/MySQL installs... maybe some weird WAMP issue?
Brad Bell
CC BY-SA 4.0
2018-06-19T18:19:20.023Z
Thanks for all your help @BradBell. I've tried everything last weeks, but none of the many things I checked and did that fixed this problem for other people on the net worked. So I'm at the point I gave up, at least for now, and decided to setup craft manually which I just did. That worked, at least for the plugin store. But I see other people asking the same question, so I probably can do that manually too. Thanks again!
Friksel
CC BY-SA 4.0
2018-06-30T18:49:32.863Z
I just found the solution to my problem @BradBell : the problem was ESET. See my answer below. Thanks for your help! Finally ready to use craft3!
Friksel
<craft3><composer>
Solved: Unable to get composer running to install CraftCMS
# Solved: Unable to get composer running to install CraftCMS

(Asked by: username_0 on 2018-06-11)

for last weeks really I try to install composer, but it keeps complaining about SSL-problems. I searched everywhere on Google and found lots of people having the same problems, but for some reason they found solutions which don't work here.

I really need to install composer, 'cause I like to use Craft 3, but whatever I try, it's not working. There is no composer-forum, and I guess all you guys needed to use composer to install Craft 3 too, so I hope somebody here can help. I'm really out of ideas at the moment...

I tried this:

**SETUP VIA WINDOWS INSTALLER**

* Download and run windows installer Composer 1.6.5: <https://getcomposer.org/download/>
  I see the path is pointing to the right php.exe (and the same php I use on wamp server). I don't use a proxy.
* Running `composer` after install shows me composer is installed.
* Running `composer diagnose` however shows me a `WARNING` after `https connectivity to packagist`: **The <https://packagist.org/packages.json> file could not be downloaded: SSL operation failed with code 1.**
* So in php I checked if php\_openssl is enabled and it is.
* I also have this in my `php.ini` file, pointing to a cacert.pem certificate, downloaded from <http://curl.haxx.se/ca/cacert.pem> :
  `openssl.cafile="C:\caCertificates\cacert.pem"
  openssl.capath="C:\caCertificates\"`
* Running `php --ini` on cmdline I verified it's definitely the edited `php.ini` file that is active on command line/composer use (C:\wamp64\bin\php\php7.1.16)
* I turned firewall off
* I even uninstalled wamp-server with all php-stuff and installed a complete fresh, updated, install of Wamp server (3.1.3 64b)
* But `composer diagnose` keeps throwing the warning, and composer is not working.

**SETUP VIA PHP INSTALLER**  
Than I tried the php-install script I found on getcomposer.org and run this from command line:  
`php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
php -r "if (hash_file('SHA384', 'composer-setup.php') === '544e09ee996cdf60ece3804abc52599c22b1f40f4323403c44d44fdfdd586475ca9813a858088ffbc1f233e9b180f061') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
php composer-setup.php
php -r "unlink('composer-setup.php');"`  
- It returns with:

BTW I tried above with administrative rights too.

I understand this has something to do with SSLv3, but whatever I tried, nothing seems to fix the issue. And again I tried a lot of things that worked for other people having this issue.

I'm out of ideas and composer obviously is not really helpful in showing a clue to what's the problem here.

Is there anybody here that can help me with this, or give me some direction on where to look? This is taking a lot of time and effort last weeks without luck and I'd like to start building websites with Craft 3 using composer!! Thanks!

**Tags:** craft3, composer
> **Comments:**
> **username_1**: Try setting the `cainfo` property to the path to the latest .pem file. That's really the only thing I had to change: `curl.cainfo="C:\dev\cacert\cacert.pem"`  
> **username_1**: Also, running any sort of anti-virus software on that box?  
> **username_0**: Thanks for your response @BradBell, I had set `curl.cainfo`, but just checked it again. It's still set in php.ini and points to the right location of the certificate. Also checked the slashes. I disabled the firewall before, which didn't help. I also turned off full ESET protection, including anti-virus, but even then and in cmdline administrator mode `composer diagnose` still complains. Also curl extension is enabled.  This thing is really starting to drive me insane. npm as well as yarn are running fine since day one without any problem, but not composer... Any more places to look?  
> **username_0**: And I just verified the ca-file is valid for composer by running `composer -vvv self-update`... it says: `Checked CA file C:\caCertificates\cacert.pem: valid`. So really, if composer says it is installed correctly and it can find the right cacert.pem file which also labels it as valid.... what else can there be wrong that keeps composer complaining? It seems everything is in place to me...  
> **username_1**: Hrm... running ESET here too and didn't have to make any changes to that. The main difference I see is that I'm using native IIS/MySQL installs... maybe some weird WAMP issue?  
> **username_0**: Thanks for all your help @BradBell. I've tried everything last weeks, but none of the many things I checked and did that fixed this problem for other people on the net worked. So I'm at the point I gave up, at least for now, and decided to setup craft manually which I just did. That worked, at least for the plugin store. But I see other people asking the same question, so I probably can do that manually too. Thanks again!  
> **username_0**: I just found the solution to my problem @BradBell : the problem was ESET. See my answer below. Thanks for your help! Finally ready to use craft3!  

---

## 1 answers

### Answer by username_0 on 2018-06-30. Score: 1

**Yes, after lots of trying I finally found the solution!! It was ESET causing the problem**

Today, after re-installing PHP7 from scratch (so not using wamp and its contents anymore to make sure it's not wamp setup causing these problems) and reinstalling composer again I found that even that didn't work.

So I figured it really should be in some anti-virus or other blocking tool. And I only use ESET Internet Security.

But I tried disabling both ESET firewall as well as ESET anti-virus several times before and it didn't solve the mystery of the composer connectionproblems.
So I took a closer look at ESET advanced settings more deeply now and it seems that eventhough I thought I turned everything in ESETs scans and blocks completely off (and that's exactly what ESET displays!), there happens to be a SSL-scan that wasn't turned off by that so still actively preventing composer to work.

I would say scanning SSL communication by ESET shouldn't cause any problems anyhow, just some milliseconds delay or whatever, but it obviously was completely blocking composer from reaching packagist through ssl. Turning off the SSL scan made composer reach packagist with https immediately, so finally this solves the mystery.

For people coming here with the same problem with composer and SSL and use ESET too, if you set up php and composer correctly then you should try this on ESET to solve the problem:

* Enter ESET advanced setup (via rightclick menu on ESET icon)
* Open up 'Web and email', and then the 'SSL/TLS' tab
* Click the 'edit'-link after 'List of SSL/TLS filtered applications' (a dialog opens)
* Check if the php.exe composer is using is in the list and if it does: make sure the scan action is set to 'ignore'. That prevents ESET from scanning the traffic via SSL from php.exe. Perhaps you could also add some certificate to the 'List of known certificates' here, but I solved it this way instead.
* If php.exe is not in the list you should get a dialog window when running
  a composer command like 'composer diagnose' that needs ssl with packagist and ESET shows a dialog box for the new connection: set it to IGNORE. Scan will result in composer throwing warnings and having no connection with packagist.
* If php.exe is not in the list and you don't get the ESET dialog window for the new connection when running 'composer diagnose' either you probably don't have the 'SSL/TLS protocol filtering mode' in ESET (under 'web and email'/SSL/TLS tab in advanced settings) set to interactive mode. Set it to interactive mode than.
* If none of the above worked you could also choose to fully turn off all SSL/TLS protocol filtering in ESET by just switching it off in 'web and email' --> SSL/TLS --> Enable SSL/TLS protocol filtering. Then ESET isn't scanning any SSL anymore.

Hopefully this helps more people having the same issue.

Thisone really caused me headages for last weeks because it hold me back from switching to craft 3. So I'm really excited I finally got an answer to this now!! Finally it's time to move to the more important stuff!

> **Comments:**
> **username_1**: WOW, that's some incredible debugging and thanks for the follow-up! Hopefully it'll help someone in the future as well.  

---

