|
Installation
To use PHP's OpenSSL support you must also compile PHP --with-openssl.
The OpenSSL library also has additional requirements for normal operation at
run-time. Most notably, OpenSSL requires access to a random or pseudo-random
number generator; on most Unix and Unix-like platforms (including Linux),
this means that it must have access to a /dev/urandom or
/dev/random device.
The configure option --with-system-ciphers
is available which causes PHP to use the system cipher list instead of a hard-coded default.
Note:
Note to Win32 Users
In order for this extension to work, there are
DLL files that must be available to the Windows
system PATH. For information on how to do this, see the
FAQ entitled "How do I add my PHP directory to the PATH
on Windows". Although copying DLL
files from the PHP folder into the Windows system directory also works
(because the system directory is by default in the system's
PATH), this is not recommended.
This extension requires the following files to be in the
PATH:
libeay32.dll,
or, as of OpenSSL 1.1, libcrypto-*.dll
Additionally, if you are planning to use the key generation and certificate
signing functions, you will need to install a valid
openssl.cnf file on your system.
We include a sample configuration file
in our win32 binary distributions, in the
extras/ssl directory.
PHP will search for the openssl.cnf using the
following logic:
-
the
OPENSSL_CONF environmental variable, if
set, will be used as the path (including filename) of the configuration
file.
-
the
SSLEAY_CONF environmental variable, if
set, will be used as the path (including filename) of the configuration
file.
-
The file openssl.cnf will be assumed to be
found in the default certificate area, as configured at the time that
the openssl DLL was compiled. This is usually means that the default
filename is C:\Program Files\Common Files\SSL\openssl.cnf (x64)
or C:\Program Files (x86)\Common Files\SSL\openssl.cnf (x86), or,
prior to PHP 7.4.0, C:\usr\local\ssl\openssl.cnf.
In your installation, you need to decide whether to install the
configuration file in the default path or
whether to install it someplace else and use environmental variables
(possibly on a per-virtual-host basis) to locate the configuration file.
Note that it is possible to override the default path from the script using
the options of the functions that require a
configuration file.
Caution
Ensure that non-privileged users are not allowed to modify openssl.cnf.
As of OpenSSL 3.0.0, which is used on Windows by default as of PHP 8.2.0, several
algorithms have been deemed legacy. Such algorithms have commonly fallen out of use,
have been deemed insecure by the cryptography community, or something similar.
These algorithms are still available via the legacy provider
(extras/ssl/legacy.dll); its usage is described in the
» provider configuration
section of the OpenSSL manual.
|