如何在Ubuntu 22.04上使用OpenSSL 1.1.1正确编译PHP 7.4.33

8ljdwjyq  于 2023-01-04  发布在  PHP
关注(0)|答案(1)|浏览(1668)

Ubuntu 22.04包含与PHP 7.4.33不兼容的OpenSSL 3。在支持SSL的Ubuntu 22.04上,从自定义路径中的源代码构建PHP 7.4.33会导致在PHP中使用SSL功能时出现SSL operation failed错误(即简单的file_get_contents("https://google.com");)。
我们需要在自定义路径中构建,并且Docker/Container也不是这里的选项。
任何帮助将不胜感激!

  1. # Install OpenSSL
  2. wget https://www.openssl.org/source/openssl-1.1.1s.tar.gz;
  3. tar xvf openssl-1.1.1s.tar.gz;
  4. cd openssl-1.1.1s/;
  5. ./Configure --prefix=/opt/build --openssldir=/opt/build -fPIC -shared linux-x86_64 -Wl,--enable-new-dtags,-rpath,'$(LIBRPATH)';
  6. make -j 8 && make install;
  7. cd ../;
  8. # Install PHP
  9. wget https://www.php.net/distributions/php-7.4.33.tar.gz;
  10. tar xf php-7.4.33.tar.gz;
  11. cd php-7.4.33/;
  12. export PKG_CONFIG_PATH=/opt/build/lib/pkgconfig;
  13. ./buildconf --force;
  14. ./configure --prefix=/opt/php \
  15. --with-curl \
  16. --with-openssl=/opt/build \
  17. --with-openssl-dir=/opt/build;
  18. make -j 8 && make install;

上面的最小构建版本似乎可以成功编译,但运行/opt/php/bin/php -r 'echo file_get_contents("https://google.com");'会导致:

  1. root@ubuntu2204:~/php-7.4.33# /opt/php/bin/php -r 'echo file_get_contents("https://google.com");'
  2. Warning: file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages:
  3. error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed in Command line code on line 1
  4. Warning: file_get_contents(): Failed to enable crypto in Command line code on line 1
  5. Warning: file_get_contents(https://google.com): failed to open stream: operation failed in Command line code on line 1

make末尾,我看到以下警告:

  1. /usr/bin/ld: warning: libssl.so.3, needed by /usr/lib/gcc/x86_64-linux-gnu/11/../../../x86_64-linux-gnu/libcurl.so, may conflict with libssl.so.1.1
  2. /usr/bin/ld: warning: libcrypto.so.3, needed by /usr/lib/gcc/x86_64-linux-gnu/11/../../../x86_64-linux-gnu/libcurl.so, may conflict with libcrypto.so.1.1
  3. /usr/bin/ld: warning: libssl.so.3, needed by /usr/lib/gcc/x86_64-linux-gnu/11/../../../x86_64-linux-gnu/libcurl.so, may conflict with libssl.so.1.1
  4. /usr/bin/ld: warning: libcrypto.so.3, needed by /usr/lib/gcc/x86_64-linux-gnu/11/../../../x86_64-linux-gnu/libcurl.so, may conflict with libcrypto.so.1.1
  5. /usr/bin/ld: warning: libssl.so.3, needed by /usr/lib/gcc/x86_64-linux-gnu/11/../../../x86_64-linux-gnu/libcurl.so, may conflict with libssl.so.1.1
  6. /usr/bin/ld: warning: libcrypto.so.3, needed by /usr/lib/gcc/x86_64-linux-gnu/11/../../../x86_64-linux-gnu/libcurl.so, may conflict with libcrypto.so.1.1

另外,PHP似乎很困惑,同时使用OpenSSL 3.0.2和OpenSSL 1.1.1s?

  1. root@ubuntu2204:~/php-7.4.33# /opt/php/bin/php -i | grep OpenSSL
  2. SSL Version => OpenSSL/3.0.2
  3. OpenSSL support => enabled
  4. OpenSSL Library Version => OpenSSL 1.1.1s 1 Nov 2022
  5. OpenSSL Header Version => OpenSSL 1.1.1s 1 Nov 2022
  6. OpenSSL support => enabled

此外,我还尝试过使用curl和附加标志进行构建,但这会导致同样的错误。

  1. # Install OpenSSL
  2. wget https://www.openssl.org/source/openssl-1.1.1s.tar.gz;
  3. tar xvf openssl-1.1.1s.tar.gz;
  4. cd openssl-1.1.1s/;
  5. ./Configure --prefix=/opt/build --openssldir=/opt/build -fPIC -shared linux-x86_64 -Wl,--enable-new-dtags,-rpath,'/opt/build/lib';
  6. make -j 8 && make install;
  7. cd ../;
  8. export CFLAGS="-I/opt/build/include/ -L/opt/build/lib -Wl,-rpath,/opt/build/lib -lssl -lcrypto"
  9. export CXXFLAGS="-I/opt/build/include/ -L/opt/build/lib -Wl,-rpath,/opt/build/lib -lssl -lcrypto"
  10. # Install Curl
  11. wget http://curl.haxx.se/download/curl-7.58.0.tar.bz2
  12. tar -xvjf curl-7.58.0.tar.bz2
  13. cd curl-7.58.0
  14. export PKG_CONFIG_PATH=/opt/build/lib/pkgconfig;
  15. export LD_LIBRARY_PATH=/opt/build/lib;
  16. ./buildconf
  17. ./configure --prefix=/opt/build --with-ssl=/opt/build
  18. make -j 8 && make install;
  19. cd ../;
  20. # Install PHP
  21. wget https://www.php.net/distributions/php-7.4.33.tar.gz;
  22. tar xf php-7.4.33.tar.gz;
  23. cd php-7.4.33/;
  24. export PKG_CONFIG_PATH=/opt/build/lib/pkgconfig;
  25. export LD_LIBRARY_PATH=/opt/build/lib;
  26. ./buildconf --force;
  27. PKG_CONFIG_PATH=/opt/build/lib/pkgconfig ./configure --prefix=/opt/php \
  28. --with-curl=/opt/build \
  29. --with-openssl=/opt/build
  30. --with-libdir=/opt/build/lib;
  31. make -j 8 && make install;
j5fpnvbx

j5fpnvbx1#

我们通过upwork提供的付费支持已经发现了这个问题。希望这能帮助其他人。只需要将PHP指向openssl.cnf和CA证书路径。
1.构建OpenSSL

  1. wget https://www.openssl.org/source/openssl-1.1.1s.tar.gz;
  2. tar xvf openssl-1.1.1s.tar.gz;
  3. cd openssl-1.1.1s/;
  4. ./Configure --prefix=/opt/build --openssldir=/opt/build -fPIC -shared linux-x86_64;
  5. make -j 8 && make install;
  6. cd ../;

1.设置pkgconfig,并为默认openssl.cnf路径设置ENV

  1. export PKG_CONFIG_PATH=/opt/build/lib/pkgconfig
  2. export OPENSSL_CONF=/usr/lib/ssl/openssl.cnf;

1.构建和安装PHP

  1. wget https://www.php.net/distributions/php-7.4.33.tar.gz;
  2. tar xf php-7.4.33.tar.gz;
  3. cd php-7.4.33/;
  4. ./buildconf --force;
  5. ./configure --prefix=/opt/php \
  6. --with-curl \
  7. --with-openssl=/opt/build;
  8. make -j 8 && make install;

1.将php.ini-production复制到/opt/php/lib/中:

  1. cp php.ini-production /opt/php/lib/php.ini;

1.配置php.ini文件中的/usr/lib/ssl/certs文件

  1. sed -i 's/;openssl.capath=/openssl.capath=\/usr\/lib\/ssl\/certs\//g' /opt/php/lib/php.ini;

1.应生成HTML输出的测试

  1. /opt/php/bin/php -r 'echo file_get_contents("https://google.com");'
展开查看全部

相关问题