[Pro] Allow installation on corporate networks (HTTP Proxy)

Bug report

I wanted to give a try to PHPStan Pro but I cannot download it:

$ ./vendor/bin/phpstan --pro -vv

Note: Using configuration file /opt/app-root/src/phpstan.dist.neon.
Could not download the PHPStan Pro executable: Connection to tls://fixer-download-api.phpstan.com:443 timed out after 5 seconds (ETIMEDOUT)

Try different DNS servers in your configuration file:

parameters:
	pro:
		dnsServers!:
			- '8.8.8.8'

I did the "dnsServers" trick but it's not changing anything, I know what's blocking the request, it's the corporate proxy enforced by my client on developer computers.

I don't think the ReactPHP Socket Connector supports HTTP Proxy:

https://github.com/phpstan/phpstan-src/blob/32f351a24ce103f120f413cd104bc411608df109/src/Command/FixerApplication.php#L326-L336

When it comes to proxy, config file (like for dnsServers) or env vars are usually supported:

$ echo $HTTPS_PROXY
http://proxy-xxx.intra.xxx:8080/

I see two paths on this issue:

adding support for HTTP Proxy on the "downloadPhar" method
allowing to download the Phar manually

Thanks a lot 🙏

Code snippet that reproduces the problem

No response

Expected output

I expect to be able to run "--pro" from a corporate network / computer. It should download the Phar using the system proxy configuration.

Did PHPStan help you today? Did it make you happy in any way?

No response

This bug report is missing a link to reproduction at phpstan.org/try.

It will most likely be closed after manual review.

What does this proxy involve? Do you have another root CA added to your system?

Yes absolutelly - it's based on ZScaler for reference. But that's already understood by PHP / my system.

For example this snippet works:

$c = array(
    'http' => array(
        'proxy'           => 'tcp://10.0.XX.XX:9000',
        'request_fulluri' => true,
    ),
);

$file = file_get_contents('https://fixer-download-api.phpstan.com/latest', false, stream_context_create($c));

var_dump($file);

PHPStan uses its own CA bundle based on https://github.com/composer/ca-bundle so that malicious parties cannot intercept and change the downloaded file on the way.

I've already added Cloudfront CA to the bundle for similar reasons. If you have a public and trusted root certificate, I could add it too.

Can I download the trusted and verified root CA for your situation too?

I'm afraid that's not possible (private banking company involved).

And if I understand correctly, even if support for HTTP CONNECT was added, I would be stopped by the internal certificate anyway?

Thanks for looking into it anyway 🙏 ❤️

How do you please provide your own CA file to PHP so that the code you showed in #11244 (comment) works out of the box?

I'm not sure, they are installed on the system, I see them running trust list (XXX is the obfuscated company name).

$ trust list
pkcs11:XXXtype=cert
    type: certificate
    label: XXX Root
    trust: anchor
    category: authority

pkcs11:XXXtype=cert
    type: certificate
    label: XXX SUB
    trust: anchor
    category: authority

I have a similar problem with the FixerApplication Command ignoring my proxy environment variables entirely. My proxy does not involve any TLS/CA magic.

Could not download the PHPStan Pro executable: Connection to tls://fixer-download-api.phpstan.com:443 timed out after 5 seconds (ETIMEDOUT)

Using curl I can connect with no issue at all.

curl -v https://fixer-download-api.phpstan.com
* Uses proxy env variable no_proxy == 'localhost'
* Uses proxy env variable https_proxy == 'http://x.x.x.x:xxxx'
*   Trying x.x.x.x:xxxx...
* Connected to (nil) (x.x.x.x) port xxxx (#0)
* allocate connect buffer!
* Establish HTTP proxy tunnel to fixer-download-api.phpstan.com:443
> CONNECT fixer-download-api.phpstan.com:443 HTTP/1.1
> Host: fixer-download-api.phpstan.com:443
> User-Agent: curl/7.81.0
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 200 Connection established
< Server: SimpleHTTP/0.6 Python/3.7.3
< Date: Fri, 22 Nov 2024 07:43:04 GMT
< Proxy-Agent: SimpleHTTP/0.6 Python/3.7.3
<
* Proxy replied 200 to CONNECT request
* CONNECT phase completed!
[...]

I would guess you can use a custom ca bundle with php by passing it e.g. via your php.ini

https://stackoverflow.com/a/75288875

@staabm

@staabm I don't think so. Both PHPStan and PHPStan Pro come with its own CA bundle inside their PHAR files.

@ondrejmirtes

@ondrejmirtes maybe phpstan pro should have a cli arg which allows to pass a cacert path, like e.g. curl allows it

https://stackoverflow.com/a/41772652

I'm stuck having the same problem trying to activate PRO

Haven't been able to use my Pro version in years do to this. Still paying to support the project but honestly hoping for a fix soon.

Issue is similar: I need to use a http proxy, which doesn't alter anything regarding TLS or the CA. Code snippet above #11244 (comment) works like a charm.

Hello,
We try to enable the Pro version inside a Bank network, behind a Proxy, without any success.
Looking forward to have a possibility to ignore the security certificate, specify a certificate, manually download the PHPStan Pro executable, or having it directly through Packagist maybe?

PHPStan now uses plain Guzzle which should definitely work better: phpstan/phpstan-src@a3af1cd

Please test it by doing composer require --dev phpstan/phpstan:2.1.x-dev and running vendor/bin/phpstan --pro. Thank you!

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

Navigation Menu

Repository navigation

[Pro] Allow installation on corporate networks (HTTP Proxy) #11244

Bug report

Code snippet that reproduces the problem

Expected output

Did PHPStan help you today? Did it make you happy in any way?

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Pro] Allow installation on corporate networks (HTTP Proxy) #11244

Description

Bug report

Code snippet that reproduces the problem

Expected output

Did PHPStan help you today? Did it make you happy in any way?

Activity

mergeable commented on Jun 27, 2024

ondrejmirtes commented on Jun 27, 2024

damienalexandre commented on Jun 28, 2024

ondrejmirtes commented on Jun 28, 2024

damienalexandre commented on Jun 28, 2024

ondrejmirtes commented on Jun 28, 2024

damienalexandre commented on Jul 1, 2024

delassiter commented on Nov 22, 2024

staabm commented on Dec 14, 2024

ondrejmirtes commented on Dec 14, 2024

staabm commented on Dec 14, 2024

jonathanpmartins commented on Feb 10, 2025

delassiter commented on Aug 6, 2025

Elendev commented on Sep 29, 2025

ondrejmirtes commented on Mar 11, 2026

github-actions commented on Apr 12, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions