PHP 5.6 certificate verification failure in Joomla - phpmailer

Question

This link describes some otpions to fix this problem: https://github.com/PHPMailer/PHPMailer/wiki/Troubleshooting#php-56-certificate-verification-failure
But I simply don't know what to do specifically in Joomla and how to prevent this verification, because I can't set up ssl for my site.
warning:
Warning: stream_socket_enable_crypto(): SSL operation failed with code 1. OpenSSL Error messages: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed in /nfsmnt/hosting1_1/1/b/1bec1745-5e90-43d0-beb1-2d132937948b/domain.com/web/libraries/vendor/phpmailer/phpmailer/class.smtp.php on line 344
What is the sense of this verification, when so many websites don't run ssl?
Piece of code in Joomla library (class.smtp.php)
// Begin encrypted connection
if (!stream_socket_enable_crypto(
$this->smtp_conn,
true,
STREAM_CRYPTO_METHOD_TLS_CLIENT
)) {
return false;
}
return true;
}

Answer 1

You are missing the point. It's not the site that's using SSL, it's the mail server you are connecting to. For example if you use PHPMailer to send a message via your gmail account, the connection to gmail will be encrypted, regardless of whether your web server is.
The problem you are running into is that the mail server you are using is misconfigured. If it is advertising encryption to inbound connections, it should use a valid certificate. The error will be that the certificate has expired, is a self-signed certificate (and thus can't be trusted), or does not match the host name that you have connected to. The instructions in the guide tell you how to disable these checks, and they should be applied at the point PHPMailer is used, not by altering the library itself. You can find where to do this in the Joomla code base by searching for instances of new PHPMailer and following it with the code that sets the degraded SSL options in the guide. Bear in mind though that this is the wrong way to fix it. If your mail server can't be fixed, use a proper hosting company that knows what it's doing.
As for "not many sites run SSL", that's just not true. All sites should run SSL, but many do not. There is really no excuse not to now that you can get free real certificates with minimal hassle. For more compelling aguments, read this.