openssl libctx implementation needs broader scoping

[brett-moser-eschat]

Description

Attempting to upgrade from php 8.4.18 to 8.5.3, without changing anything else, has caused issues with the use of the OpenSSL extension.

1. using mysqli/mysqlnd we were unable to open a TLS 1.3 connection to a MySQL database. The SSL_CTX_new() was returning an error, indicating no available Ciphers. Changing to the use of SSL_CTX_new_ex(), and passing in the libctx global, fixed this issue.

2. attempts to use openssl_random_pseudo_bytes() generated [Exception] Error reading from source device that was traced back to RAND_bytes() which required a similar uplift to RAND_bytes_ex()

There is uncertainty whether additional OpenSSL functions still need to be modified to use LIBCTX, these are the only examples encountered thus far.

Environment:

Running in a containerized environment based on redhat UBI 9.6 with FIPS cryptography enabled using OpenSSL 3.5.1 and the OpenSSL 3.0.7 FIPS provider.

patches that got things working (NOTE: these are quick hacks clearly not the correct way to implement given the multiple backends (v1 vs v3) support:

diff --git a/ext/openssl/openssl_backend_common.c b/ext/openssl/openssl_backend_common.c
index 33ffa55e489..09a1f1f4f57 100644
--- a/ext/openssl/openssl_backend_common.c
+++ b/ext/openssl/openssl_backend_common.c
@@ -30,6 +30,7 @@
 #define timezone _timezone     /* timezone is called _timezone in LibC */
 #endif
 
+ZEND_EXTERN_MODULE_GLOBALS(openssl)
 
 /* openssl -> PHP "bridging" */
 /* true global; readonly after module startup */
@@ -2053,7 +2054,7 @@ PHP_OPENSSL_API zend_string* php_openssl_random_pseudo_bytes(zend_long buffer_le
        buffer = zend_string_alloc(buffer_length, 0);
 
        PHP_OPENSSL_CHECK_LONG_TO_INT_NULL_RETURN(buffer_length, length);
-       if (RAND_bytes((unsigned char*)ZSTR_VAL(buffer), (int)buffer_length) <= 0) {
+       if (RAND_bytes_ex(PHP_OPENSSL_LIBCTX, (unsigned char*)ZSTR_VAL(buffer), (int)buffer_length, 256) <= 0) {
                php_openssl_store_errors();
                zend_string_release_ex(buffer, 0);
                zend_throw_exception(zend_ce_exception, "Error reading from source device", 0);
diff --git a/ext/openssl/xp_ssl.c b/ext/openssl/xp_ssl.c
index db71a3c325a..beebd58f32d 100644
--- a/ext/openssl/xp_ssl.c
+++ b/ext/openssl/xp_ssl.c
@@ -150,6 +150,8 @@
 #define HAVE_IPV6_SAN 1
 #endif
 
+ZEND_EXTERN_MODULE_GLOBALS(openssl)
+
 extern php_stream* php_openssl_get_stream_from_ssl_handle(const SSL *ssl);
 extern zend_string* php_openssl_x509_fingerprint(X509 *peer, const char *method, bool raw);
 extern int php_openssl_get_ssl_stream_data_index(void);
@@ -1302,7 +1304,7 @@ static SSL_CTX *php_openssl_create_sni_server_ctx(char *cert_path, char *key_pat
 {
        /* The hello method is not inherited by SSL structs when assigning a new context
         * inside the SNI callback, so the just use SSLv23 */
-       SSL_CTX *ctx = SSL_CTX_new(SSLv23_server_method());
+       SSL_CTX *ctx = SSL_CTX_new_ex(PHP_OPENSSL_LIBCTX, PHP_OPENSSL_PROPQ, SSLv23_server_method());
 
        if (SSL_CTX_use_certificate_chain_file(ctx, cert_path) != 1) {
                php_error_docref(NULL, E_WARNING,
@@ -1576,10 +1578,32 @@ static zend_result php_openssl_setup_crypto(php_stream *stream,
        method_flags = cparam->inputs.method & ~STREAM_CRYPTO_IS_CLIENT;
 
        method = sslsock->is_client ? SSLv23_client_method() : SSLv23_server_method();
-       sslsock->ctx = SSL_CTX_new(method);
+       sslsock->ctx = SSL_CTX_new_ex(PHP_OPENSSL_LIBCTX, PHP_OPENSSL_PROPQ, method);

PHP Version

PHP 8.5.3 (cli) (built: Feb 16 2026 22:11:01) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.5.3, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.3, Copyright (c), by Zend Technologies

Operating System

Redhat UBI 9.6 w/ FIPS provider