This is an example of how to set up stream_socket_server to connect with multiple Secure Websockets on WSS (wss://) that uses SSL / TLS as a Transport.
This runs on a Windows Apache Server with a registered domain and SSL Cert from LetsEncrypt via Certbot.
Run this script from a console "php server.php", and javascript html as a client with:
socket = new WebSocket('wss://php.net:1234');
<?php
$host = '192.168.1.2';
$port = 1234;
$path = 'C:/Certbot/live/php.net/';
$transport = 'tlsv1.3';
$ssl = ['ssl' => [
'local_cert' => $path . 'cert.pem', // SSL Certificate
'local_pk' => $path . 'privkey.pem', // SSL Keyfile
'disable_compression' => true, // TLS compression attack vulnerability
'verify_peer' => false, // Set this to true if acting as an SSL client
'ssltransport' => $transport, // Transport Methods such as 'tlsv1.1', tlsv1.2'
] ];
$ssl_context = stream_context_create($ssl);
$server = stream_socket_server($transport . '://' . $host . ':' . $port, $errno, $errstr, STREAM_SERVER_BIND|STREAM_SERVER_LISTEN, $ssl_context);
if (!$server) { die("$errstr ($errno)"); }
$clients = array($server);
$write = NULL;
$except = NULL;
while (true) {
$changed = $clients;
stream_select($changed, $write, $except, 10);
if (in_array($server, $changed)) {
$client = @stream_socket_accept($server);
if (!$client){ continue; }
$clients[] = $client;
$ip = stream_socket_get_name( $client, true );
echo "New Client connected from $ip\n";
stream_set_blocking($client, true);
$headers = fread($client, 1500);
handshake($client, $headers, $host, $port);
stream_set_blocking($client, false);
send_message($clients, mask($ip . ' connected'));
$found_socket = array_search($server, $changed);
unset($changed[$found_socket]);
}
foreach ($changed as $changed_socket) {
$ip = stream_socket_get_name( $changed_socket, true );
$buffer = stream_get_contents($changed_socket);
if ($buffer == false) {
echo "Client Disconnected from $ip\n";
@fclose($changed_socket);
$found_socket = array_search($changed_socket, $clients);
unset($clients[$found_socket]);
}
$unmasked = unmask($buffer);
if ($unmasked != "") { echo "\nReceived a Message from $ip:\n\"$unmasked\" \n"; }
$response = mask($unmasked);
send_message($clients, $response);
}
}
fclose($server);
function unmask($text) {
$length = @ord($text[1]) & 127;
if($length == 126) { $masks = substr($text, 4, 4); $data = substr($text, 8); }
elseif($length == 127) { $masks = substr($text, 10, 4); $data = substr($text, 14); }
else { $masks = substr($text, 2, 4); $data = substr($text, 6); }
$text = "";
for ($i = 0; $i < strlen($data); ++$i) { $text .= $data[$i] ^ $masks[$i % 4]; }
return $text;
}
function mask($text) {
$b1 = 0x80 | (0x1 & 0x0f);
$length = strlen($text);
if($length <= 125)
$header = pack('CC', $b1, $length);
elseif($length > 125 && $length < 65536)
$header = pack('CCn', $b1, 126, $length);
elseif($length >= 65536)
$header = pack('CCNN', $b1, 127, $length);
return $header.$text;
}
function handshake($client, $rcvd, $host, $port){
$headers = array();
$lines = preg_split("/\r\n/", $rcvd);
foreach($lines as $line)
{
$line = rtrim($line);
if(preg_match('/\A(\S+): (.*)\z/', $line, $matches)){
$headers[$matches[1]] = $matches[2];
}
}
$secKey = $headers['Sec-WebSocket-Key'];
$secAccept = base64_encode(pack('H*', sha1($secKey . '258EAFA5-E914-47DA-95CA-C5AB0DC85B11')));
//hand shaking header
$upgrade = "HTTP/1.1 101 Web Socket Protocol Handshake\r\n" .
"Upgrade: websocket\r\n" .
"Connection: Upgrade\r\n" .
"WebSocket-Origin: $host\r\n" .
"WebSocket-Location: wss://$host:$port\r\n".
"Sec-WebSocket-Version: 13\r\n" .
"Sec-WebSocket-Accept:$secAccept\r\n\r\n";
fwrite($client, $upgrade);
}
function send_message($clients, $msg){
foreach($clients as $changed_socket){
@fwrite($changed_socket, $msg);
}
}
?>PHP - Manual: stream_socket_server
2025-10-31
stream_socket_server
(PHP 5, PHP 7, PHP 8)
stream_socket_server — 创建 Internet 或 Unix 域服务器套接字
说明
stream_socket_server(
string
int
string
int
?resource
): resource|false
string
$address,int
&$error_code = null,string
&$error_message = null,int
$flags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN,?resource
$context = null): resource|false
在指定 address 上创建 stream 或者数据包套接字（datagram socket）。
此函数仅创建套接字，并使用 stream_socket_accept() 开始接受连接。
参数
address-
传输器决定创建的套接字类型，其传输器由标准 URL 格式（
transport://target）指定。对于 Internet 域套接字（
AF_INET），比如 TCP 和 UDP，remote_socket参数的target部分应由主机名或者 IP 地址，随后跟着冒号和端口号组成。 对于 Unix 域套接字，target部分指向文件系统中的套接字文件。环境的不同，可能会导致 Unix 域套接字无法使用。可以使用 stream_get_transports() 检索可以使用的传输器列表。查看所支持的套接字传输器列表获取内置传输器列表。
error_code-
如果指定了可选的
error_code和error_message参数，它们将被设置为指出在系统级别进行socket()、bind()、listen()调用时发生的真实系统级别错误。如果error_code返回的值为0且函数返回false，则表明错误发生在bind()调用之前。请注意error_code和error_message始终通过引用传递。 error_message-
参阅
error_code描述。 flags-
位掩码字段，可以设置为套接字创建 flag 的任意组合。
注意:
对于 UDP 套接字，你必须使用
STREAM_SERVER_BIND作为flags参数。 context-
返回值
返回已创建的 stream，错误时返回 false。
更新日志
| 版本 | 说明 |
|---|---|
| 8.0.0 |
context 现在可为 null。
|
示例
示例 #1 使用 TCP 服务器套接字
<?php
$socket = stream_socket_server("tcp://0.0.0.0:8000", $errno, $errstr);
if (!$socket) {
echo "$errstr ($errno)<br />\n";
} else {
while ($conn = stream_socket_accept($socket)) {
fwrite($conn, 'The local time is ' . date('n/j/Y g:i a') . "\n");
fclose($conn);
}
fclose($socket);
}
?>下面的示例展示了如何充当时间服务器，可以响应时间查询，正如 stream_socket_client() 上的示例。
注意: 大多数系统在低于 1024 的端口号上创建服务器套接字时需要 root 访问权限。
示例 #2 使用 UDP 服务器套接字
<?php
$socket = stream_socket_server("udp://127.0.0.1:1113", $errno, $errstr, STREAM_SERVER_BIND);
if (!$socket) {
die("$errstr ($errno)");
}
do {
$pkt = stream_socket_recvfrom($socket, 1, 0, $peer);
echo "$peer\n";
stream_socket_sendto($socket, date("D M j H:i:s Y\r\n"), 0, $peer);
} while ($pkt !== false);
?>注释
注意: 当指定数值型的 IPv6 地址（例如
fe80::1）时必须用方括号将 IP 围起来——例如，tcp://[fe80::1]:80。
参见
- stream_socket_client() - Open Internet or Unix domain socket connection
- stream_set_blocking() - 为资源流设置阻塞或者阻塞模式
- stream_set_timeout() - Set timeout period on a stream
- fgets() - 从文件指针中读取一行
- fgetss() - 从文件指针中读取一行并过滤掉 HTML 标记
- fwrite() - 写入文件（可安全用于二进制文件）
- fclose() - 关闭一个已打开的文件指针
- feof() - 测试文件指针是否到了文件结束的位置
- Curl 扩展
＋添加备注
用户贡献的备注 6 notes
Heretic86 at roadrunner dot com ¶
4 years ago
blackmac01 at gmail dot com ¶
9 years ago
I'm writing an HTTP server and I need SSL support, but getting this to work correctly with PHP streams took a bit of trial and error. For anyone who is trying to get an HTTP SSL server working with stream_socket_server:
1) Your SSL context will need to contain 'local_cert'. If you did not include your private key with your local_cert, you'll also need to specify 'local_pk' which is your RSA key. Your keys and certs should be PEM encoded, which means base-64. If your certificate has intermediary certs, you will need to specify those in the correct order: Your signed cert, intermediary cert 1, intermediary cert 2, etc. Each cert in the list needs to validate the one above it, but you do not need to include the CA Root that your SSL signer provided; that should already be included with the client's software (i.e. trust root certs).
You can append your private key in the file with your certs, however I keep mine in its own file. If you see the word "encrypted" when you view your key with a text viewer, you need to enter the correct passphrase and specify the context "passphrase", otherwise you can leave that one out.
As a server, verify_peer is irrelevant and should be set to false (should always be true if you are acting as an SSL client). Both cafile and capath contexts are not needed for functioning as a SSL/TLS server, but they are needed if you are making SSL connections with PHP as the client.
Lastly, the 'ciphers' context should be set to a list of secure ciphers. Search for "mozilla recommended ciphers" and choose the string of ciphers that works for you, because not all openssl supported ciphers are secure. I went with the "intermediate" list, which provides high security and compatibility.
2) When you create the binding for stream_socket_server(), make sure that you choose the tcp:// wrapper. DO NOT USE ssl:// or tls://. Anything other than tcp:// will not work correctly AS A SERVER, those transports are what you use when making connections with PHP as a client.
Remember that the encryption does not start until after an SSL handshake completes, so the server has to listen in non-encrypted mode for new connections, and encryption doesn't start until certs are exchanged and a cipher is selected. When a new connection arrives you accept it with stream_socket_accept() and then use stream_socket_enable_crypto() to start the SSL session.
3) Keep in mind that the SSL handshake takes time, and that the stream_socket wrappers are high level and not as responsive as the socket extension due to the additional overhead they incur. For this reason you will need to enable blocking for accepting new connections.
<enable blocking on ServerListenStream>
newConnStream = stream_socket_accept(ServerListenStream);
<disable blocking on ServerListenStream>
<enable blocking on newConnStream >
stream_socket_enable_crypto(newConnStream, true, STREAM_CRYPTO_METHOD_SSLv23_SERVER);
<disable blocking on newConnStream >
Note that this is mainly for HTTP. If you are trying to do something like SMTP then your script will have to react to the "starttls" command, but it would be similar to the above except that you would wait for the "starttls" command before invoking the stream_socket_enable_crypto() function on the client's stream.
TLS 1.0 is generally the way to go, SSLv3 is insecure and SSLv2 is buggy. If you use the mozilla recommend cipher list in your context, you'll be fine. Hope this helps someone out!
davidm at marketo dot com ¶
15 years ago
In some specialized scenarios, you may want to create an AF_INET socket (UDP or TCP) but let the system select an unused port for you. This is a standard feature of internet sockets but it doesn't seem to be documented how to do this for the stream_socket_server function. It appears you can get this behavior by selecting zero for the port number, for example, my test below printed "127.0.0.1:4960".
<?php
$sock = stream_socket_server("udp://127.0.0.1:0");
$name = stream_socket_get_name($sock);
echo $name;
?>
frxstrem ¶
14 years ago
Using the OpenSSL extension, PHP can automatically generate self-signed SSL certificates, which can be used for basic authentication and encryption (although I would recommend to use a signed certificate instead) for SSL servers.
I have extended the script by 'e at osterman dot com' to automatically create self-signed certificates:
<?php
// Hello World! SSL HTTP Server.
// Tested on PHP 5.1.2-1+b1 (cli) (built: Mar 20 2006 04:17:24)
// Certificate data:
$dn = array(
"countryName" => "UK",
"stateOrProvinceName" => "Somerset",
"localityName" => "Glastonbury",
"organizationName" => "The Brain Room Limited",
"organizationalUnitName" => "PHP Documentation Team",
"commonName" => "Wez Furlong",
"emailAddress" => "wez@example.com"
);
// Generate certificate
$privkey = openssl_pkey_new();
$cert = openssl_csr_new($dn, $privkey);
$cert = openssl_csr_sign($cert, null, $privkey, 365);
// Generate PEM file
# Optionally change the passphrase from 'comet' to whatever you want, or leave it empty for no passphrase
$pem_passphrase = 'comet';
$pem = array();
openssl_x509_export($cert, $pem[0]);
openssl_pkey_export($privkey, $pem[1], $pem_passphrase);
$pem = implode($pem);
// Save PEM file
$pemfile = './server.pem';
file_put_contents($pemfile, $pem);
$context = stream_context_create();
// local_cert must be in PEM format
stream_context_set_option($context, 'ssl', 'local_cert', $pemfile);
// Pass Phrase (password) of private key
stream_context_set_option($context, 'ssl', 'passphrase', $pem_passphrase);
stream_context_set_option($context, 'ssl', 'allow_self_signed', true);
stream_context_set_option($context, 'ssl', 'verify_peer', false);
// Create the server socket
$server = stream_socket_server('ssl://0.0.0.0:9001', $errno, $errstr, STREAM_SERVER_BIND|STREAM_SERVER_LISTEN, $context);
while(true)
{
$buffer = '';
print "waiting...";
$client = stream_socket_accept($server);
print "accepted " . stream_socket_get_name( $client, true) . "\n";
if( $client )
{
// Read until double CRLF
while( !preg_match('/\r?\n\r?\n/', $buffer) )
$buffer .= fread($client, 2046);
// Respond to client
fwrite($client, "200 OK HTTP/1.1\r\n"
. "Connection: close\r\n"
. "Content-Type: text/html\r\n"
. "\r\n"
. "Hello World! " . microtime(true)
. "<pre>{$buffer}</pre>");
fclose($client);
} else {
print "error.\n";
}
}
?>
andrey at php dot net ¶
20 years ago
Just a small example how to use this function and also stream_select() to make a server that accepts more than one connections (can have many clients connected):
In master we hold all opened connections. Just before calling stream select we copy the array to $read and then pass it ot stream_select(). In case that we may read from at least one socket, $read will contain socket descriptors. $master is needed not to lose references to the opened connections we have.
stream_server.php :
<?php
$master = array();
$socket = stream_socket_server("tcp://0.0.0.0:8000", $errno, $errstr);
if (!$socket) {
echo "$errstr ($errno)<br />\n";
} else {
$master[] = $socket;
$read = $master;
while (1) {
$read = $master;
$mod_fd = stream_select($read, $_w = NULL, $_e = NULL, 5);
if ($mod_fd === FALSE) {
break;
}
for ($i = 0; $i < $mod_fd; ++$i) {
if ($read[$i] === $socket) {
$conn = stream_socket_accept($socket);
fwrite($conn, "Hello! The time is ".date("n/j/Y g:i a")."\n");
$master[] = $conn;
} else {
$sock_data = fread($read[$i], 1024);
var_dump($sock_data);
if (strlen($sock_data) === 0) { // connection closed
$key_to_del = array_search($read[$i], $master, TRUE);
fclose($read[$i]);
unset($master[$key_to_del]);
} else if ($sock_data === FALSE) {
echo "Something bad happened";
$key_to_del = array_search($read[$i], $master, TRUE);
unset($master[$key_to_del]);
} else {
echo "The client has sent :"; var_dump($sock_data);
fwrite($read[$i], "You have sent :[".$sock_data."]\n");
fclose($read[$i]);
unset($master[array_search($read[$i], $master)]);
}
}
}
}
}
?>
stream_client.php:
<?php
$fp = stream_socket_client("tcp://127.0.0.1:8000", $errno, $errstr, 30);
if (!$fp) {
echo "$errstr ($errno)<br />\n";
} else {
fwrite($fp, "Aloha");
while (!feof($fp)) {
var_dump(fgets($fp, 1024));
}
fclose($fp);
}
?>
Thanks
peterjb at me dot com ¶
15 years ago
I had a horrible time trying to shove a TLS socket into an existing TCP program. It appears to me that functions like stream_socket_recvfrom and stream_socket_sendto don't work with TLS/SSL (which may be obvious to PHP gurus...sorry if it is, I'm in a bit over my head here).
In the end I ended up doing all my IO with fread() and fwrite(), which solved all my problems.官方地址：https://www.php.net/manual/en/function.stream-socket-server.php
IT
PHP
编程语言
开发编程
Linux
科技
Elasticsearch
HTML/CSS/XML
面试
数据库
网络
JAVA
NoSQL
C/C++
Golang
操作系统
Git
算法
正则表达式
Redis
互联网
MySql
软件
运维
JavaScript
国际
架构设计
Mac OS
Excel
TCP/IP
Windows
Oracle
Socket
Vim
VR
MongoDB
运营
Python
MemCache
商业
硬件
电子
娱乐
设计
摄影
nginx
WordPress
游戏
HTTP
团建
数码电器
Docker
广告
php7.3 使用 PDO_DM 扩展连接 DM8 中文乱码
PhpStorm中PHP注释的规范指南
使用PHPWord将docx文件转换为html格式
docker-compose启动nginx与php-fpm
laravel查看orm生成的sql
PHPStorm ESC 会退出命令行
composer install参数
laravel orm中DB::insert方法导致内存泄漏的问题解决方法
php7 安装fileinfo扩展
adodb手册
ADORecordSet对象
常用的php ADODB使用方法集锦
ADOConnection 公用函数
利用php soap实现web service
adodb连接mysql多个数据库的问题
mysql面试题
[PHP] inet_pton/inet_ntop IP地址转换函数
PHP json解析（json_decode）页面工具
PHP7添加redis扩展
PHP注释规范