# 警告: stream_socket_enable_crypto(): SSL 操作失败，代码 1。OpenSSL 错误信息: error:14094458:SSL routines:ssl3_read_bytes:tlsv1 unrecognized name，位于 /var/www/app/src/Mailer/SmtpTransport.php:25

- **ID:** `php/stream-socket-ssl-sni`
- **领域:** php
- **类别:** protocol_error
- **错误码:** `14094458`
- **验证级别:** ai_generated
- **修复率:** 82%

## 根因

SSL/TLS 握手失败，因为服务器的主机名与 PHP 发送的 SNI（服务器名称指示）扩展不匹配，通常由于流上下文中缺少或错误的 peer_name。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| PHP 8.1 | active | — | — |
| PHP 8.2 | active | — | — |
| PHP 8.3 | active | — | — |
| OpenSSL 1.1.1 | active | — | — |
| OpenSSL 3.0 | active | — | — |

## 解决方案

1. ```
   Set the 'peer_name' context option to the correct hostname: $context = stream_context_create(['ssl' => ['peer_name' => 'mail.example.com']]); $stream = stream_socket_client('tls://mail.example.com:465', $errno, $errstr, 30, STREAM_CLIENT_CONNECT, $context);
   ```
2. ```
   If using PHP's built-in mail function or PHPMailer, ensure the SMTP host matches the certificate's common name. For example, use 'smtp.example.com' instead of an IP address.
   ```
3. ```
   Enable SNI by default in PHP 8.2+: set 'sni_enabled' to true in the stream context: stream_context_set_option($context, 'ssl', 'sni_enabled', true);
   ```

## 无效尝试

- **** — Disabling SSL verification (verify_peer=false) bypasses the error but exposes the connection to man-in-the-middle attacks; it does not fix the SNI mismatch. (90% 失败率)
- **** — Updating the CA certificate bundle alone does not resolve SNI issues; the peer_name must explicitly match the server's certificate CN or SAN. (70% 失败率)