升级Ubuntu至22.04后Laravel-Predis SSL连接失败求助

环境背景 #

• 原运行环境：EC2服务器、Ubuntu 18.04、Laravel 5.3、PHP 7.1
• 操作：升级操作系统至Ubuntu 22.04，按原有流程安装依赖后，连接Redis集群失败

错误提示 #

执行相关操作时抛出以下异常：

[ErrorException]
stream_socket_enable_crypto(): SSL operation failed with code 1. OpenSSL Error messages:
error:0A0C0103:SSL routines::internal error:

laravel.log中的完整堆栈信息：

[2023-06-25 13:02:01] production.ERROR: ErrorException: stream_socket_enable_crypto(): SSL operation failed with code 1. OpenSSL Error messages:
error:0A0C0103:SSL routines::internal error in /home/ubuntu/app/vendor/predis/predis/src/Connection/StreamConnection.php:246
Stack trace:
#0 [internal function]: Illuminate\Foundation\Bootstrap\HandleExceptions->handleError(2, 'stream_socket_e...', '/home/ubuntu/ve...', 246, Array)
#1 /home/ubuntu/app/vendor/predis/predis/src/Connection/StreamConnection.php(246): stream_socket_enable_crypto(Resource id #520, true, 9)
#2 /home/ubuntu/app/vendor/predis/predis/src/Connection/StreamConnection.php(107): Predis\Connection\StreamConnection->tlsStreamInitializer(Object(Predis\Connection\Parameters))
#3 /home/ubuntu/app/vendor/predis/predis/src/Connection/AbstractConnection.php(81): Predis\Connection\StreamConnection->createResource()
#4 /home/ubuntu/app/vendor/predis/predis/src/Connection/StreamConnection.php(258): Predis\Connection\AbstractConnection->connect()
#5 /home/ubuntu/app/vendor/predis/predis/src/Connection/AbstractConnection.php(157): Predis\Connection\StreamConnection->connect()
#6 /home/ubuntu/app/vendor/predis/predis/src/Connection/StreamConnection.php(288): Predis\Connection\AbstractConnection->getResource()
#7 /home/ubuntu/app/vendor/predis/predis/src/Connection/StreamConnection.php(395): Predis\Connection\StreamConnection->write('*2\r\n$3\r\nGET\r\n$3...')
#8 /home/ubuntu/app/vendor/predis/predis/src/Connection/AbstractConnection.php(110): Predis\Connection\StreamConnection->writeRequest(Object(Predis\Command\Redis\GET))
#9 /home/ubuntu/app/vendor/predis/predis/src/Client.php(341): Predis\Connection\AbstractConnection->executeCommand(Object(Predis\Command\Redis\GET))
#10 /home/ubuntu/app/vendor/predis/predis/src/Client.php(324): Predis\Client->executeCommand(Object(Predis\Command\Redis\GET))
#11 /home/ubuntu/app/app/Containers/RedisReplica.php(23): Predis\Client->__call('get', Array)
#12 /home/ubuntu/app/bootstrap/cache/compiled.php(6468): App\Containers\RedisReplica->get('pricing_checked...')
#13 /home/ubuntu/app/app/Helpers/CacheHelper.php(171): Illuminate\Support\Facades\Facade::__callStatic('get', Array)
#14 /home/ubuntu/app/app/Console/Commands/Tests/TestCommand.php(920): App\Helpers\CacheHelper::getPricingCheckedForListing(1)
#15 /home/ubuntu/app/app/Console/Commands/Tests/TestCommand.php(135): App\Console\Commands\Tests\TestCommand->cacheReplica()
#16 [internal function]: App\Console\Commands\Tests\TestCommand->handle()
#17 /home/ubuntu/app/bootstrap/cache/compiled.php(1375): call_user_func_array(Array, Array)
#18 /home/ubuntu/app/vendor/laravel/framework/src/Illuminate/Console/Command.php(169): Illuminate\Container\Container->call(Array)
#19 /home/ubuntu/app/vendor/symfony/console/Command/Command.php(261): Illuminate\Console\Command->execute(Object(Symfony\Component\Console\Input\ArgvInput), Object(Symfony\Component\Console\Output\ConsoleOutput))
#20 /home/ubuntu/app/vendor/laravel/framework/src/Illuminate/Console/Command.php(155): Symfony\Component\Console\Command\Command->run(Object(Symfony\Component\Console\Input\ArgvInput), Object(Symfony\Component\Console\Output\ConsoleOutput))
#21 /home/ubuntu/app/vendor/symfony/console/Application.php(817): Illuminate\Console\Command->run(Object(Symfony\Component\Console\Input\ArgvInput), Object(Symfony\Component\Console\Output\ConsoleOutput))
#22 /home/ubuntu/app/vendor/symfony/console/Application.php(185): Symfony\Component\Console\Application->doRunCommand(Object(App\Console\Commands\Tests\TestCommand), Object(Symfony\Component\Console\Input\ArgvInput), Object(Symfony\Component\Console\Output\ConsoleOutput))
#23 /home/ubuntu/app/vendor/symfony/console/Application.php(116): Symfony\Component\Console\Application->doRun(Object(Symfony\Component\Console\Input\ArgvInput), Object(Symfony\Component\Console\Output\ConsoleOutput))
#24 /home/ubuntu/app/vendor/laravel/framework/src/Illuminate/Foundation/Console/Kernel.php(121): Symfony\Component\Console\Application->run(Object(Symfony\Component\Console\Input\ArgvInput), Object(Symfony\Component\Console\Output\ConsoleOutput))
#25 /home/ubuntu/app/artisan(35): Illuminate\Foundation\Console\Kernel->handle(Object(Symfony\Component\Console\Input\ArgvInput), Object(Symfony\Component\Console\Output\ConsoleOutput))
#26 {main}

当前Redis配置 #

'redis' => [

    'cluster' => env('REDIS_CLUSTER', false),

    'default' => [
        'scheme'   => env('REDIS_SCHEME','tls'),
        'host'     => env('REDIS_HOST', 'somehost'),
        'port'     => env('REDIS_PORT', 6379),
        'database' => env('REDIS_DATABASE', 0),
        'password' => env('REDIS_PASSWORD', 'somepassword')
    ],

    'replica' => [
        'scheme' => env('REDIS_SCHEME','tls'),
        'host'     => env('REDIS_HOST_REPLICA', 'somehost'),
        'port'     => env('REDIS_PORT', 6379),
        'database' => env('REDIS_DATABASE', 0),
        'password' => env('REDIS_PASSWORD', 'somepassword')
    ],

    'options' => [
        'parameters' => ['password' => env('REDIS_PASSWORD', null)],
        'ssl'    => ['verify_peer' => false],
    ]
    
],

已排查情况 #

• 使用的框架、依赖版本偏旧，但未明确是否为问题诱因
• 网上同类错误多与邮件服务相关，未找到针对Predis的有效解决方案

解决方案尝试 #

1. 强制指定SSL协议版本 #

Ubuntu22.04搭载的OpenSSL 3.0.x对旧版TLS协议支持更严格，旧版Predis默认使用的协议可能不被兼容。修改Redis配置的ssl选项，指定兼容的TLS版本：

'options' => [
    'parameters' => ['password' => env('REDIS_PASSWORD', null)],
    'ssl'    => [
        'verify_peer' => false,
        'verify_peer_name' => false,
        'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT, // 强制使用TLS1.2
    ],
]

如果PHP环境不识别上述常量，可直接使用对应数值67108864替代。

2. 检查PHP OpenSSL配置 #

确保php.ini中OpenSSL扩展配置正确，Ubuntu22.04的CA证书路径如下：

extension=openssl.so
openssl.cafile=/etc/ssl/certs/ca-certificates.crt

执行php -i | grep openssl验证配置生效，同时确认证书文件存在。

3. 升级Predis版本（兼容Laravel5.3） #

旧版Predis（如1.0.x）对OpenSSL3.0兼容性较差，尝试升级到1.1.x版本（该版本兼容Laravel5.3）：

composer require predis/predis:^1.1

4. 命令行测试SSL连接 #

用OpenSSL命令直接测试Redis集群的SSL连通性，排除网络或服务端配置问题：

openssl s_client -connect your-redis-host:6379 -tls1_2

若连接成功，说明问题出在客户端配置；若失败，需检查EC2安全组、Redis集群的SSL监听配置。

内容的提问来源于stack exchange，提问作者yuvi