在 FreeBSD 中从 PHP 5.5 升级后出现 PHP 5.6 错误 "Unable to connect to ssl://"

Question

在将 PHP 5.5 升级到版本 5.6 后，我在 Magento 中的付款方式出现问题。

升级后，Magento 1.9 中的支付方式会抛出错误并生成报告(见下文)。

我的支付提供商说支付扩展使用“Zend_Http_Client 传输协议(protocol)”。

任何人都知道升级 PHP 后会导致此问题的原因是什么？

a:5:{i:0;s:56:"Unable to Connect to ssl://api.payson.se:443. Error
#0: ";i:1;s:2213:"
#0 /usr/local/www/apache24/webroot/multistore/lib/Zend/Http/Client.php(1073): Zend_Http_Client_Adapter_Socket->connect('api.payson.se', 443, true)
#1 /usr/local/www/apache24/webroot/multistore/app/code/community/Payson/Payson/Helper/Api.php(1181): Zend_Http_Client->request('POST')
#2 /usr/local/www/apache24/webroot/multistore/app/code/community/Payson/Payson/Model/Method/Abstract.php(126): Payson_Payson_Helper_Api->PaymentDetails('204103')
#3 /usr/local/www/apache24/webroot/multistore/app/code/core/Mage/Sales/Model/Order/Payment.php(1152): Payson_Payson_Model_Method_Abstract->cancel(Object(Mage_Sales_Model_Order_Payment))
#4 /usr/local/www/apache24/webroot/multistore/app/code/core/Mage/Sales/Model/Order/Payment.php(865): Mage_Sales_Model_Order_Payment->_void(true, NULL, 'cancel')
#5 /usr/local/www/apache24/webroot/multistore/app/code/core/Mage/Sales/Model/Order.php(1155): Mage_Sales_Model_Order_Payment->cancel()
#6 /usr/local/www/apache24/webroot/multistore/app/code/community/Payson/Payson/controllers/CheckoutController.php(62): Mage_Sales_Model_Order->cancel()
#7 /usr/local/www/apache24/webroot/multistore/app/code/community/Payson/Payson/controllers/CheckoutController.php(92): Payson_Payson_CheckoutController->cancelOrder('Unable to Conne...')
#8 /usr/local/www/apache24/webroot/multistore/app/code/core/Mage/Core/Controller/Varien/Action.php(418): Payson_Payson_CheckoutController->redirectAction()
#9 /usr/local/www/apache24/webroot/multistore/app/code/core/Mage/Core/Controller/Varien/Router/Standard.php(254): Mage_Core_Controller_Varien_Action->dispatch('redirect')
#10 /usr/local/www/apache24/webroot/multistore/app/code/core/Mage/Core/Controller/Varien/Front.php(172): Mage_Core_Controller_Varien_Router_Standard->match(Object(Mage_Core_Controller_Request_Http))
#11 /usr/local/www/apache24/webroot/multistore/app/code/core/Mage/Core/Model/App.php(365): Mage_Core_Controller_Varien_Front->dispatch()
#12 /usr/local/www/apache24/webroot/multistore/app/Mage.php(684): Mage_Core_Model_App->run(Array)
#13 /usr/local/www/apache24/webroot/multistore/index.php(83): Mage::run('mystore', 'store')
#14 {main}";s:3:"url";s:26:"/payson/checkout/redirect/";s:11:"script_name";s:10:"/index.php";s:4:"skin";s:8:"mystore";}

Answer 1

当使用服务器名称指示 (SNI) 和GeoTrust Global CA 根 ca 时，我可以连接 TLS 1.0(及更高版本)。证书路径按预期验证，您可以在 s_client 中使用 Verify return code: 0 (ok)。您应该在您的配置中确保所有这三个。

基于异常，我们不能从 OpenSSL 的角度说更多，因为它缺少我们需要的细节。也许更熟悉 PHP 或 Magento 的人会识别出问题并为您指出来。

$ wget https://www.geotrust.com/resources/root_certificates/certificates/GeoTrust_Global_CA.pem
...
Saving to: ‘GeoTrust_Global_CA.pem’    
...
‘GeoTrust_Global_CA.pem’ saved [1234/1234]

和:

$ openssl s_client -connect api.payson.se:443 -servername api.payson.se:443 -tls1 -CAfile GeoTrust_Global_CA.pem 
CONNECTED(00000003)
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify return:1
depth=1 C = US, O = GeoTrust Inc., CN = GeoTrust SSL CA - G3
verify return:1
depth=0 C = SE, ST = Solna, L = Solna, O = Payson AB, OU = IT, CN = *.payson.se
verify return:1
Server did acknowledge servername extension.
---
Certificate chain
 0 s:/C=SE/ST=Solna/L=Solna/O=Payson AB/OU=IT/CN=*.payson.se
   i:/C=US/O=GeoTrust Inc./CN=GeoTrust SSL CA - G3
 1 s:/C=US/O=GeoTrust Inc./CN=GeoTrust SSL CA - G3
   i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIGXDCCBUSgAwIBAgIQbV30AAbQTat7MqXktaJDmDANBgkqhkiG9w0BAQsFADBE
MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMU
R2VvVHJ1c3QgU1NMIENBIC0gRzMwHhcNMTYwNTMwMDAwMDAwWhcNMTgwNTMwMjM1
OTU5WjBkMQswCQYDVQQGEwJTRTEOMAwGA1UECAwFU29sbmExDjAMBgNVBAcMBVNv
bG5hMRIwEAYDVQQKDAlQYXlzb24gQUIxCzAJBgNVBAsMAklUMRQwEgYDVQQDDAsq
LnBheXNvbi5zZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMadr2to
9C+GhoH/23pQ4fXUTjtfZEm7thZhvd42H5hIpllv9wHLeY+52UGZ96GqozSLRG6o
Q/eRbz3AJW1zFS7pqmFeJcntfzr7HzOWvK3vyEkF/SvEigOpRwf0Ka198CG9lMhi
zfZSXCOBN3VdcuJ72zkU5gxpLC/h897EuTFQIYhK/u2/NLD7j+teDF6vufdkLgtl
D1rMa3T1AtxHTUsqsW9oVdqm2nmlXcfFIVA6yxEvyoqXsAR0bm1v2Hxcy3w92Dvb
fxCIc0IYFOzzWzBXe82E1QaYjpEpDtBEogGiyXOHB7IHEn6I2Xuo237W5gs/18u2
DlH+EEjCMmJfEc0CAwEAAaOCAygwggMkMCEGA1UdEQQaMBiCCyoucGF5c29uLnNl
gglwYXlzb24uc2UwCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQw
IjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCB
kjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVz
dC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwz
aHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xl
Z2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTS
b/eW9IU/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGG
E2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1j
Yi5jb20vZ24uY3J0MIIBfAYKKwYBBAHWeQIEAgSCAWwEggFoAWYAdgDd6x0reg1P
piCLga2BaHB+Lo6dAdVciI09EcTNtuy+zAAAAVUCYB6qAAAEAwBHMEUCICTb0Fdj
jX7yrzK80/wLA1QcoIWNtwRmzZVmQ6YgvELbAiEAy8hTQ+C7y5URM0pz73xQszDQ
Apf/TPcc+0FLG5Wnq2QAdQCkuQmQtBhYFIe7E6LMZ3AKPDWYBPkb37jjd80OyA3c
EAAAAVUCYB7cAAAEAwBGMEQCIBAb+hulV+3pM5YD2gH9QJn4AluNKOjP5Ws4dtLF
/U/sAiAwEEF6UOm3XPWvAS86eyRR5wWOTjVjvx+WiMwv/QDWgAB1AGj2mPgfZIK+
OozuuSgdTPxxUV1nk9RE0QpnrLtPT/vEAAABVQJgHuEAAAQDAEYwRAIgP0H47fdq
lZC9C8tAfvdWB99LU7VYAx1pE6zY2//tVaECIA1gTcm7oXKFSr/DY7hiKoJBiUbE
8XHO/HzHttxgAvz0MA0GCSqGSIb3DQEBCwUAA4IBAQALggFOUKnbBdZsgPqy/U6v
NExyMoex88Rkqczyak22fiZ8YDFaKi1HfJe0HtNJwqyfqovau2m/16Nx7wsyzRyI
ozjiiG/1SvYG6GICt2s37hTdMQvnnq0dkeAeavZ7BeCodu1IAsPnJi9VL8AvKSWx
GCcNV7OOaVauvlnGHke2ZDJvX1hSlCTyTqP9XZOoNvXtI8SWVCs+EW5FdRz4aGOK
IkKQfcwFGFJGGHW7f/8XkNSO6agGFKuc99pWHB6oMAm3Qe1g8G/2+SvNwhphIAYL
/s6NHGLsJ+4/i/543lNCwAWXHqZZw2twhAJm4YNe/agLCH5fvzjyvs6hxXDu7hTW
-----END CERTIFICATE-----
subject=/C=SE/ST=Solna/L=Solna/O=Payson AB/OU=IT/CN=*.payson.se
issuer=/C=US/O=GeoTrust Inc./CN=GeoTrust SSL CA - G3
---
No client certificate CA names sent
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 3236 bytes and written 262 bytes
Verification: OK
---
New, SSLv3, Cipher is ECDHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1
    Cipher    : ECDHE-RSA-AES256-SHA
    Session-ID: 514B0000016FC6A78475CFF088BF92B511EA2A593E7A3C21CB7606096400616A
    Session-ID-ctx: 
    Master-Key: 9EF49EC4B639D63B92003016C3456303D688775502D97D6ACD158F3CD64DF08F
                F626374D68B7ADD6BF24D222C198129C
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1477375819
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: yes

最后:

$ openssl version
OpenSSL 1.1.0b  26 Sep 2016