如何在Ubuntu 22.04上使用OpenSSL 1.1.1正确编译PHP 7.4.33

8ljdwjyq  于 2023-01-04  发布在  PHP
关注(0)|答案(1)|浏览(1023)

Ubuntu 22.04包含与PHP 7.4.33不兼容的OpenSSL 3。在支持SSL的Ubuntu 22.04上,从自定义路径中的源代码构建PHP 7.4.33会导致在PHP中使用SSL功能时出现SSL operation failed错误(即简单的file_get_contents("https://google.com");)。
我们需要在自定义路径中构建,并且Docker/Container也不是这里的选项。
任何帮助将不胜感激!

# Install OpenSSL
wget https://www.openssl.org/source/openssl-1.1.1s.tar.gz;
tar xvf openssl-1.1.1s.tar.gz;
cd openssl-1.1.1s/;
./Configure --prefix=/opt/build --openssldir=/opt/build -fPIC -shared linux-x86_64 -Wl,--enable-new-dtags,-rpath,'$(LIBRPATH)';
make -j 8 && make install;
cd ../;

# Install PHP
wget https://www.php.net/distributions/php-7.4.33.tar.gz;
tar xf php-7.4.33.tar.gz;
cd php-7.4.33/;
export PKG_CONFIG_PATH=/opt/build/lib/pkgconfig;
./buildconf --force;
./configure --prefix=/opt/php \
--with-curl \
--with-openssl=/opt/build \
--with-openssl-dir=/opt/build;
make -j 8 && make install;

上面的最小构建版本似乎可以成功编译,但运行/opt/php/bin/php -r 'echo file_get_contents("https://google.com");'会导致:

root@ubuntu2204:~/php-7.4.33# /opt/php/bin/php -r 'echo file_get_contents("https://google.com");'

Warning: file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages:
error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed in Command line code on line 1

Warning: file_get_contents(): Failed to enable crypto in Command line code on line 1

Warning: file_get_contents(https://google.com): failed to open stream: operation failed in Command line code on line 1

make末尾,我看到以下警告:

/usr/bin/ld: warning: libssl.so.3, needed by /usr/lib/gcc/x86_64-linux-gnu/11/../../../x86_64-linux-gnu/libcurl.so, may conflict with libssl.so.1.1
/usr/bin/ld: warning: libcrypto.so.3, needed by /usr/lib/gcc/x86_64-linux-gnu/11/../../../x86_64-linux-gnu/libcurl.so, may conflict with libcrypto.so.1.1
/usr/bin/ld: warning: libssl.so.3, needed by /usr/lib/gcc/x86_64-linux-gnu/11/../../../x86_64-linux-gnu/libcurl.so, may conflict with libssl.so.1.1
/usr/bin/ld: warning: libcrypto.so.3, needed by /usr/lib/gcc/x86_64-linux-gnu/11/../../../x86_64-linux-gnu/libcurl.so, may conflict with libcrypto.so.1.1
/usr/bin/ld: warning: libssl.so.3, needed by /usr/lib/gcc/x86_64-linux-gnu/11/../../../x86_64-linux-gnu/libcurl.so, may conflict with libssl.so.1.1
/usr/bin/ld: warning: libcrypto.so.3, needed by /usr/lib/gcc/x86_64-linux-gnu/11/../../../x86_64-linux-gnu/libcurl.so, may conflict with libcrypto.so.1.1

另外,PHP似乎很困惑,同时使用OpenSSL 3.0.2和OpenSSL 1.1.1s?

root@ubuntu2204:~/php-7.4.33# /opt/php/bin/php -i | grep OpenSSL
SSL Version => OpenSSL/3.0.2
OpenSSL support => enabled
OpenSSL Library Version => OpenSSL 1.1.1s  1 Nov 2022
OpenSSL Header Version => OpenSSL 1.1.1s  1 Nov 2022
OpenSSL support => enabled

此外,我还尝试过使用curl和附加标志进行构建,但这会导致同样的错误。

# Install OpenSSL
wget https://www.openssl.org/source/openssl-1.1.1s.tar.gz;
tar xvf openssl-1.1.1s.tar.gz;
cd openssl-1.1.1s/;
./Configure --prefix=/opt/build --openssldir=/opt/build -fPIC -shared linux-x86_64 -Wl,--enable-new-dtags,-rpath,'/opt/build/lib';
make -j 8 && make install;
cd ../;

export CFLAGS="-I/opt/build/include/ -L/opt/build/lib -Wl,-rpath,/opt/build/lib -lssl -lcrypto"
export CXXFLAGS="-I/opt/build/include/ -L/opt/build/lib -Wl,-rpath,/opt/build/lib -lssl -lcrypto"

# Install Curl
wget http://curl.haxx.se/download/curl-7.58.0.tar.bz2
tar -xvjf curl-7.58.0.tar.bz2
cd curl-7.58.0
export PKG_CONFIG_PATH=/opt/build/lib/pkgconfig;
export LD_LIBRARY_PATH=/opt/build/lib;
./buildconf
./configure --prefix=/opt/build --with-ssl=/opt/build
make -j 8 && make install;
cd ../;

# Install PHP
wget https://www.php.net/distributions/php-7.4.33.tar.gz;
tar xf php-7.4.33.tar.gz;
cd php-7.4.33/;
export PKG_CONFIG_PATH=/opt/build/lib/pkgconfig;
export LD_LIBRARY_PATH=/opt/build/lib;
./buildconf --force;
PKG_CONFIG_PATH=/opt/build/lib/pkgconfig ./configure --prefix=/opt/php \
--with-curl=/opt/build \
--with-openssl=/opt/build
--with-libdir=/opt/build/lib;
make -j 8 && make install;
j5fpnvbx

j5fpnvbx1#

我们通过upwork提供的付费支持已经发现了这个问题。希望这能帮助其他人。只需要将PHP指向openssl.cnf和CA证书路径。
1.构建OpenSSL

wget https://www.openssl.org/source/openssl-1.1.1s.tar.gz;
tar xvf openssl-1.1.1s.tar.gz;
cd openssl-1.1.1s/;
./Configure --prefix=/opt/build --openssldir=/opt/build -fPIC -shared linux-x86_64;
make -j 8 && make install;
cd ../;

1.设置pkgconfig,并为默认openssl.cnf路径设置ENV

export PKG_CONFIG_PATH=/opt/build/lib/pkgconfig
export OPENSSL_CONF=/usr/lib/ssl/openssl.cnf;

1.构建和安装PHP

wget https://www.php.net/distributions/php-7.4.33.tar.gz;
tar xf php-7.4.33.tar.gz;
cd php-7.4.33/;
./buildconf --force;
./configure --prefix=/opt/php \
--with-curl \
--with-openssl=/opt/build;
make -j 8 && make install;

1.将php.ini-production复制到/opt/php/lib/中:

cp php.ini-production /opt/php/lib/php.ini;

1.配置php.ini文件中的/usr/lib/ssl/certs文件

sed -i 's/;openssl.capath=/openssl.capath=\/usr\/lib\/ssl\/certs\//g' /opt/php/lib/php.ini;

1.应生成HTML输出的测试

/opt/php/bin/php -r 'echo file_get_contents("https://google.com");'

相关问题