eMudhra 中间 CA 私钥泄露：PHP 服务器需要检查什么

# Which CA file does PHP use? Run as the same user/SAPI as the site if you can.
php -r 'print_r(openssl_get_cert_locations());'
php -i | grep -E 'openssl.cafile|openssl.capath|curl.cainfo'

# Does PHP still trust the compromised eMudhra intermediates?
# Good result: bool(false) plus a "certificate verify failed" warning.
# Bad result: the page body is printed (the chain was trusted).
php -r 'var_dump(file_get_contents("https://dv-g3b-emudhra.we-have-a-problem.com/"));'
php -r 'var_dump(file_get_contents("https://dv-g3b-aaa-emudhra.we-have-a-problem.com/"));'

# Same check through the curl extension
php -r '$c = curl_init("https://dv-g3b-emudhra.we-have-a-problem.com/");
curl_setopt($c, CURLOPT_RETURNTRANSFER, true);
var_dump(curl_exec($c), curl_error($c));'

# Is the eMudhra root still in the bundle?
ls /etc/ssl/certs | grep -i emsign            # Debian/Ubuntu symlinks
grep -n "emSign ECC Root CA - G3" /path/to/cacert.pem   # curl/Mozilla-format bundle
# composer/ca-bundle version inside a project
composer show composer/ca-bundle | grep versions

# Debian / Ubuntu (and Debian-based php:* Docker images)
sudo apt-get update && sudo apt-get install --only-upgrade ca-certificates
dpkg -l ca-certificates

# RHEL / Fedora / AlmaLinux / Rocky
sudo dnf upgrade ca-certificates

# Alpine (php:*-alpine images)
apk upgrade --no-cache ca-certificates

# Composer projects that ship composer/ca-bundle
composer update composer/ca-bundle    # 1.4.16+ or 1.6.0+

# Restart long-running PHP processes afterwards
sudo systemctl restart php8.3-fpm     # or apache2 / httpd / your queue workers

; php.ini — for stacks with their own stale bundle (XAMPP, WAMP, old panels)
; Download a current Mozilla-derived bundle from https://curl.se/ca/cacert.pem
; (the 2026-10-20 release or later), then point both settings at it:
curl.cainfo   = "/path/to/cacert.pem"
openssl.cafile = "/path/to/cacert.pem"
; Restart Apache / PHP-FPM so the new values load.