CentOS7+Plesk Onyx环境下PHP8.0用sqlsrv连SQL Server遇SSL证书错误

环境与问题描述 #

环境：CentOS7 + Plesk Onyx面板 + PHP8.0 + sqlsrv扩展
连接SQL Server时触发SSL证书验证错误，错误信息如下：

Array
(
    [0] => Array
        (
            [0] => 08001
            [SQLSTATE] => 08001
            [1] => -1
            [code] => -1
            [2] => [Microsoft][ODBC Driver 18 for SQL Server]SSL Provider: [error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:self signed certificate]
            [message] => [Microsoft][ODBC Driver 18 for SQL Server]SSL Provider: [error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:self signed certificate]
        )

    [1] => Array
        (
            [0] => 08001
            [SQLSTATE] => 08001
            [1] => -1
            [code] => -1
            [2] => [Microsoft][ODBC Driver 18 for SQL Server]Client unable to establish connection. For solutions related to encryption errors, see https://go.microsoft.com/fwlink/?linkid=2226722
            [message] => [Microsoft][ODBC Driver 18 for SQL Server]Client unable to establish connection. For solutions related to encryption errors, see https://go.microsoft.com/fwlink/?linkid=2226722
        )

)

已在连接代码中添加"TrustServerCertificate" => "yes"参数，但问题未解决，连接代码如下：

$params = [
    "UID" => $username,
    "PWD" => $password,
    "Database" => $database,
    "TrustServerCertificate" => "yes"
];
if(sqlsrv_connect($host, $params)) {
    echo "connected..";
} else {
    echo "Connection could not be established.<br />";
    echo "<pre>";
    die( print_r( sqlsrv_errors(), true));
    echo "</pre>";
}

解决办法 #

1. 补充Encrypt连接参数 #

ODBC Driver 18默认强制加密连接，单独设置TrustServerCertificate可能无法覆盖默认行为，尝试在参数中添加"Encrypt" => "no"：

$params = [
    "UID" => $username,
    "PWD" => $password,
    "Database" => $database,
    "TrustServerCertificate" => "yes",
    "Encrypt" => "no"
];

2. 修改ODBC全局配置文件 #

如果PHP层面参数不生效，直接修改系统ODBC配置：

• 编辑/etc/odbcinst.ini文件，找到[ODBC Driver 18 for SQL Server]小节，添加或修改以下配置：

  [ODBC Driver 18 for SQL Server]
  Description=Microsoft ODBC Driver 18 for SQL Server
  Driver=/opt/microsoft/msodbcsql18/lib64/libmsodbcsql-18.3.so.2.1
  UsageCount=1
  TrustServerCertificate=Yes
  Encrypt=No
  

• 保存后重启Plesk的PHP8.0-FPM服务：

  systemctl restart plesk-php80-fpm
  

3. 检查Plesk面板PHP全局配置 #

• 登录Plesk面板，进入「工具与设置」>「PHP设置」> 选择PHP8.0版本
• 进入「附加配置」页面，检查是否存在sqlsrv.TrustServerCertificate参数，若存在确保值为On；若不存在，添加该参数并设置为On
• 保存后重启对应PHP服务

4. 导入自签证书到系统信任库（如需保持加密连接） #

如果需要保留加密连接，可将SQL Server的自签证书导入CentOS信任库：

• 获取SQL Server的.crt格式证书文件
• 将证书复制到/etc/pki/ca-trust/source/anchors/目录
• 执行命令更新信任库：

  update-ca-trust extract
  

• 重启PHP-FPM服务后重试连接

内容的提问来源于stack exchange，提问作者ButcherFromHell