Plugging mcrypt into PHP on macOS Mojave 10.14

Back by popular demand i.e. someone was struggling with ciphers in PHP and doing so on my dime. This will be quicker than prior implementations as we are going to dispense with building libmcrypt from source, as well as roll 64-bit only.

First, grab/do the following …

1) PHP 7.1.23 source code, which is available here; it is what my machine was running as of late, but you should use php -v to check your version of PHP and then download the PHP source for that version;

2) Xcode 10.2.1, available from the Mac App Store; you will also need the Command Line Tools (macOS 10.14) for Xcode, which you get by selecting “Xcode/Open Developer Tool/More Developer Tools…” from the Xcode menu, then logging into your Apple Developer account; it was at the top of the list as of the morning this post was written;

3) Homebrew ( which can be installed by typing ruby -e “$(curl -fsSL install/master/install)” at the command line; I removed Homebrew completely then reinstalled, rather than deal with updates, permissions issues, etc. that might arise after numerous macOS updates/upgrades;

4) Turn off System Integrity Protection (SIP):

  • Click the Apple menu (upper left hand corner of your screen)
  • Select Restart, then hold down the Command-R keys to boot into Recovery Mode
  • Select the Utilities menu and then Terminal
  • In Terminal, type csrutil disable and then hit return; then close Terminal
  • Click the Apple menu and select Restart
  • When you are done installing mcrypt, you can restart SIP by following the above steps while using csrutil enable.

Open Terminal

You are going to do a few things with brew first:

$ brew install autoconf pkg-config
$ brew install libmcrypt

Unlike previous tutorials, libmcrypt is taken care of with the above. Now we move to PHP, which means get into the directory where the php-7.1.23 source code download resides and type this:

$ tar -zxvf php-7.1.23.tar.gz

Now we are going to grab the header files for macOS. You do that by typing the following (all one line, despite how it looks):

$ sudo installer -pkg /Library/Developer/CommandLineTools/Packages/macOS_SDK_headers_for_macOS_10.14.pkg -target /

Next, move to the php-7.1.23/ext/mcrypt/ directory created by the previous “unzipping”, and type these things, one by one while giving each step time to complete:

$ phpize
$ ./configure
$ make
$ make test
$ sudo make install

Promise kept as we are nearly done

Go to the /etc directory, and look for php.ini. You may see just php.ini.default, so rename it to php.ini. Open it, and look for …

enable_dl = On

Then add one line in the Dynamic Extensions section …

PHP is very likely already enabled, but if not open the /etc/apache2/httpd.conf file and remove the “#” from in front of …

LoadModule php7_module libexec/apache2/

Save and close.

Restart Apache with …

$ sudo apachectl start

And point your browser to a file that contains the following:

<?php phpinfo(); ?>

You should see this at the top:

And this down below:

If you are still a skeptic i.e. consistently forget to clear your browser cache (or don’t know how), there is another way to test. Create a new file – let’s call it mcrypt_test.php – in which you will insert the following (deprecated but working) code:

var_dump(mcrypt_module_self_test(MCRYPT_RIJNDAEL_128)) . "\n";

Place this file in your WebServer/Documents directory, then point your browser to localhost/mcrypt_test.php. You should see the following:

bool(true) bool(false)

MG signing off (so have a nice day)


Greg Hoole says:

Great article! Found one issue – before running phpize you need to go into php-7.1.23/ext/mcrypt

Raffaele says:

Sorry, how do you revert macOS to its factory state, i.e. how do I uninstall mcrypt and all the stuff you mention in your post?


Delete the line “” under Dynamic Extensions in the php.ini file, and delete the file found under /usr/lib/php/extensions/no-debug-non-zts/20160303/.

Deezer says:

Seems as if this causes problems for php since the code is not signed:

Warning: PHP Warning: PHP Startup: Unable to load dynamic library ‘/usr/lib/php/extensions/no-debug-non-zts-20160303/’ – dlopen(/usr/lib/php/extensions/no-debug-non-zts-20160303/, 0x0009): code signature in (/usr/lib/php/extensions/no-debug-non-zts-20160303/ not valid for use in process: mapped file has no cdhash, completely unsigned? Code has to be at least ad-hoc signed. in Unknown on line 0

Suggested fix?

SIP off when this was compiled?

Deezer says:

Also, all should note that Mcrypt is deprecated now in PHP and you should probably try to get rid of references to it in your code.

Yep. libsodium is the modern library, and while there are instructions here to get that running as an extension even that is no longer necessary.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.