Ubuntu 上 PHP SSL 错误的定位与修复指南
一、先快速定位错误类型
php -r "var_dump(file_get_contents('https://www.example.com/'));"
php -r '$ch=curl_init();curl_setopt($ch,CURLOPT_URL,"https://www.example.com/");curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);var_dump(curl_exec($ch));var_dump(curl_error($ch));'
二、常见场景与对应修复
CA 证书缺失或过期(cURL error 60 / verify failed)
sudo apt-get update
sudo apt-get install --reinstall ca-certificates
sudo update-ca-certificates --fresh
openssl.cafile=/etc/ssl/certs/ca-certificates.crt
; 或
curl.cainfo=/etc/ssl/certs/ca-certificates.crt
修改后重启 PHP-FPM/Apache。sudo mkdir -p /usr/local/openssl/ssl/certs
sudo curl -o /usr/local/openssl/ssl/certs/cacert.pem https://curl.se/ca/cacert.pem
# php.ini
openssl.cafile=/usr/local/openssl/ssl/certs/cacert.pem
curl.cainfo=/usr/local/openssl/ssl/certs/cacert.pem
重启服务后复测。自签名或私有 CA 证书
openssl.cafile=/path/to/bundle.crt
curl.cainfo=/path/to/bundle.crt
编译期 OpenSSL 与运行期不匹配(段错误、undefined reference 等)
# 准备 OpenSSL 1.1.1(如系统为 3.x 且需兼容旧版)
wget https://www.openssl.org/source/old/1.1.1/openssl-1.1.1.tar.gz
tar xf openssl-1.1.1.tar.gz && cd openssl-1.1.1
./Configure --prefix=/opt/openssl-1.1.1 -fPIC shared linux-x86_64
make -j$(nproc) && sudo make install
# 编译 PHP 时显式指定 OpenSSL
export PKG_CONFIG_PATH=/opt/openssl-1.1.1/lib/pkgconfig
export LD_LIBRARY_PATH=/opt/openssl-1.1.1/lib
./configure --with-openssl=/opt/openssl-1.1.1 [你的其他选项]
make -j$(nproc) && sudo make install
三、验证与回退
四、实用命令清单
sudo apt-get install --reinstall ca-certificates
sudo update-ca-certificates --fresh
ls -l /etc/ssl/certs/ca-certificates.crt
php -i | grep -E 'openssl|curl|SSL_CTX_set_default_verify_paths'
php -r 'var_dump(openssl_get_cert_locations());'
curl -V
ldd $(php -r 'echo ini_get("extension_dir");')/curl.so | grep ssl
readelf -Ws $(which php) | grep -i tls
sudo systemctl restart php-fpm
sudo systemctl restart apache2