DEV Community

Yashvi Kothari
Yashvi Kothari

Posted on

DNS, SSL & PHP on Linux: Practical DevOps Guide

#dns #ssl #php #linux

DNS, SSL & PHP on Linux: A Practical Guide for DevOps Engineers

Learn DNS records, SPF, DKIM, DMARC, SSL certificates, Let's Encrypt, PHP-FPM, Nginx, and PHP troubleshooting with practical Linux commands.

DNS, SSL & PHP on Linux: What Every DevOps Engineer Should Know

A website can be running perfectly on a server and still be unreachable.

Why?

Because infrastructure has layers.

Your application may be healthy.
Your web server may be running.
Your SSL certificate may be valid.

But if DNS points to the wrong IP, users never reach your server.

And if SSL is misconfigured, they may reach it—but receive a certificate error.

And if PHP-FPM is broken, Nginx may return a 502 Bad Gateway.

This is why DevOps engineers need to understand the entire path:

Domain → DNS → Server → Web Server → SSL/TLS → Application Runtime

Let's break down the most important concepts and commands.

1. Understanding DNS Records

DNS, or Domain Name System, translates human-readable domain names into information computers can use.

For example:

example.com → 192.168.1.100
Enter fullscreen mode Exit fullscreen mode

The most important DNS records to know are:

Record Purpose
A Maps a domain to an IPv4 address
AAAA Maps a domain to an IPv6 address
CNAME Creates an alias to another domain
MX Defines mail servers
TXT Stores text data such as SPF and verification records
NS Defines authoritative nameservers
SOA Contains authority information for a DNS zone
PTR Maps an IP address back to a domain
SRV Defines the location of specific services
CAA Controls which certificate authorities can issue certificates

The key distinction to remember:

A record → IP address

CNAME → another domain name

That simple difference appears frequently in DevOps and infrastructure interviews.

2. DNS Troubleshooting With Linux Commands

When a domain isn't resolving correctly, don't immediately blame the application.

Start with DNS.

Check the A record 

dig example.com
Enter fullscreen mode Exit fullscreen mode

Or:

dig example.com A
Enter fullscreen mode Exit fullscreen mode

For a cleaner result:

dig +short example.com
Enter fullscreen mode Exit fullscreen mode

Query a specific DNS resolver

Google DNS:

dig @8.8.8.8 example.com
Enter fullscreen mode Exit fullscreen mode

Cloudflare DNS:

dig @1.1.1.1 example.com
Enter fullscreen mode Exit fullscreen mode

This is useful when troubleshooting DNS propagation or resolver-specific problems.

Check MX records 

dig example.com MX
Enter fullscreen mode Exit fullscreen mode

Check TXT records 

dig example.com TXT
Enter fullscreen mode Exit fullscreen mode

Check nameservers 

dig example.com NS
Enter fullscreen mode Exit fullscreen mode

Check reverse DNS 

dig -x 192.168.1.100
Enter fullscreen mode Exit fullscreen mode

This checks the PTR record.

3. SPF, DKIM and DMARC

DNS isn't only about websites.

It's also critical for email security.

Three records you should understand are:

SPF

DKIM

DMARC

SPF

SPF specifies which servers are authorized to send email for a domain.

Example:

v=spf1 ip4:192.168.1.100 include:_spf.google.com include:sendgrid.net ~all
Enter fullscreen mode Exit fullscreen mode

The important idea:

SPF answers: “Which servers are allowed to send email for this domain?”

DKIM

DKIM adds a cryptographic signature to outgoing email.

The receiving mail server can use that signature to verify that the message hasn't been improperly modified.

A DKIM record is commonly stored under:

selector._domainkey.example.com
Enter fullscreen mode Exit fullscreen mode

DMARC

DMARC tells receiving mail servers what to do when SPF or DKIM checks fail.

Example:

v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100
Enter fullscreen mode Exit fullscreen mode

Possible policies include:

p=none
p=quarantine
p=reject
Enter fullscreen mode Exit fullscreen mode

A useful mental model is:

SPF → Who can send?

DKIM → Was the message cryptographically signed?

DMARC → What should happen if authentication fails?

4. SSL/TLS: Securing Web Traffic

DNS gets users to your server.

SSL/TLS secures the communication between the client and server.

Modern systems use TLS. SSL is the older terminology.

For most Linux web servers, HTTPS traffic is handled on:

443
Enter fullscreen mode Exit fullscreen mode

HTTP commonly uses:

80
Enter fullscreen mode Exit fullscreen mode

5. Let's Encrypt and Certbot

One of the most common ways to obtain free TLS certificates is Let's Encrypt.

Certbot automates much of the certificate process.

Install it:

sudo apt update
sudo apt install certbot
Enter fullscreen mode Exit fullscreen mode

Apache 

sudo apt install python3-certbot-apache
sudo certbot --apache -d example.com -d www.example.com
Enter fullscreen mode Exit fullscreen mode

Nginx 

sudo apt install python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com
Enter fullscreen mode Exit fullscreen mode

Standalone mode

If no web server is running:

sudo certbot certonly --standalone -d example.com
Enter fullscreen mode Exit fullscreen mode

Webroot mode

If a web server is already running:

sudo certbot certonly \
  --webroot \
  -w /var/www/example.com/public \
  -d example.com \
  -d www.example.com
Enter fullscreen mode Exit fullscreen mode

6. SSL Renewal

Getting the certificate is only half the job.

You also need to make sure it doesn't expire.

Check certificates:

sudo certbot certificates
Enter fullscreen mode Exit fullscreen mode

Test renewal:

sudo certbot renew --dry-run
Enter fullscreen mode Exit fullscreen mode

Renew certificates:

sudo certbot renew
Enter fullscreen mode Exit fullscreen mode

You can also verify the Certbot systemd timer:

sudo systemctl status certbot.timer
Enter fullscreen mode Exit fullscreen mode

A good production habit is:

Don't wait for users to discover that your certificate expired.

Automate renewal and test it before you need it.

7. Troubleshooting SSL From the Command Line

When HTTPS isn't behaving correctly, OpenSSL is one of your best friends.

Check the TLS connection:

openssl s_client \
  -connect example.com:443 \
  -servername example.com
Enter fullscreen mode Exit fullscreen mode

Check certificate dates:

echo | openssl s_client \
  -connect example.com:443 2>/dev/null |
  openssl x509 -noout -dates
Enter fullscreen mode Exit fullscreen mode

Check certificate details:

echo | openssl s_client \
  -connect example.com:443 2>/dev/null |
  openssl x509 -noout -text
Enter fullscreen mode Exit fullscreen mode

These commands help you investigate:

  • Certificate expiration
  • Certificate details
  • TLS connections
  • Certificate configuration

8. Common SSL Errors

ERR_CERT_HAS_EXPIRED

The certificate has expired.

Potential solution:

sudo certbot renew
Enter fullscreen mode Exit fullscreen mode

ERR_CERT_COMMON_NAME_INVALID

The certificate doesn't match the requested domain.

For example:

Requested:
api.example.com

Certificate:
example.com
Enter fullscreen mode Exit fullscreen mode

The certificate needs to cover the appropriate hostname.

Certificate chain incomplete

The server may be missing an intermediate certificate.

A full certificate chain may be required.

Mixed content

The main website uses HTTPS, but some resources still use HTTP.

For example:

https://example.com
Enter fullscreen mode Exit fullscreen mode

loading:

http://example.com/style.css
Enter fullscreen mode Exit fullscreen mode

That can trigger browser security warnings.

9. Installing PHP on Linux

PHP is commonly used for dynamic web applications.

With Apache:

sudo apt install php libapache2-mod-php
Enter fullscreen mode Exit fullscreen mode

With Nginx, PHP typically runs through PHP-FPM:

sudo apt install php-fpm php-cli
Enter fullscreen mode Exit fullscreen mode

PHP-FPM stands for:

PHP FastCGI Process Manager

It manages PHP worker processes separately from Nginx.

10. Why PHP-FPM Matters With Nginx

Nginx doesn't execute PHP code directly.

Instead, the architecture looks like this:

Client
   ↓
Nginx
   ↓
PHP-FPM
   ↓
PHP Application
   ↓
Database
Enter fullscreen mode Exit fullscreen mode

Nginx receives the HTTP request.

PHP-FPM manages PHP processes.

The PHP application executes.

This separation is one reason PHP-FPM is commonly used with Nginx.

11. Configure PHP-FPM

A common PHP-FPM pool configuration is:

/etc/php/8.2/fpm/pool.d/www.conf
Enter fullscreen mode Exit fullscreen mode

Important settings include:

user = www-data
group = www-data
listen = /var/run/php/php8.2-fpm.sock
Enter fullscreen mode Exit fullscreen mode

PHP-FPM can communicate through a Unix socket or TCP:

listen = /var/run/php/php8.2-fpm.sock
Enter fullscreen mode Exit fullscreen mode

or:

listen = 127.0.0.1:9000
Enter fullscreen mode Exit fullscreen mode

Unix sockets are commonly used when Nginx and PHP-FPM are on the same server.

12. PHP-FPM Process Management

PHP-FPM supports different process manager modes:

pm = dynamic
Enter fullscreen mode Exit fullscreen mode

Other options include:

static
ondemand
Enter fullscreen mode Exit fullscreen mode

For dynamic mode, important settings include:

pm.max_children = 50
pm.start_servers = 5
pm.min_spare_servers = 5
pm.max_spare_servers = 35
pm.max_requests = 500
Enter fullscreen mode Exit fullscreen mode

These settings control how PHP worker processes are created and managed.

The important operational lesson is:

PHP performance isn't only about PHP code. Process management matters too.

13. PHP Configuration

The main PHP configuration file is php.ini.

Find the configuration being used:

php --ini
Enter fullscreen mode Exit fullscreen mode

You can also inspect specific settings:

php -i | grep memory_limit
Enter fullscreen mode Exit fullscreen mode 
php -i | grep upload_max_filesize
Enter fullscreen mode Exit fullscreen mode

Common production settings include:

memory_limit = 256M
upload_max_filesize = 64M
post_max_size = 70M
max_execution_time = 300
max_input_time = 300
max_input_vars = 5000
date.timezone = Asia/Kolkata
Enter fullscreen mode Exit fullscreen mode

For production:

display_errors = Off
log_errors = On
Enter fullscreen mode Exit fullscreen mode

A production server should log errors rather than expose them directly to visitors.

14. OPcache for PHP Performance

PHP can improve performance by caching compiled bytecode.

That's where OPcache comes in.

Example configuration:

opcache.enable = 1
opcache.memory_consumption = 128
opcache.max_accelerated_files = 10000
opcache.revalidate_freq = 2
Enter fullscreen mode Exit fullscreen mode

The principle is simple:

Don't repeatedly do work that can be cached safely.

This is one of the small configuration decisions that can have a meaningful effect on application performance.

15. Multiple PHP Versions

Sometimes different applications require different PHP versions.

You can install multiple PHP-FPM versions:

sudo apt install php7.4-fpm php8.0-fpm php8.1-fpm php8.2-fpm
Enter fullscreen mode Exit fullscreen mode

You can also change the CLI version:

sudo update-alternatives --config php
Enter fullscreen mode Exit fullscreen mode

The bigger advantage is that Nginx can route different websites to different PHP-FPM sockets.

For example:

location ~ \.php$ {
    fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
}
Enter fullscreen mode Exit fullscreen mode

Another site could use:

location ~ \.php$ {
    fastcgi_pass unix:/var/run/php/php8.2-fpm.sock;
}
Enter fullscreen mode Exit fullscreen mode

This allows different applications to coexist on the same server with different runtime requirements.

16. Composer

Composer is the package manager commonly used for PHP projects.

Install it and then use commands such as:

composer install
Enter fullscreen mode Exit fullscreen mode 
composer update
Enter fullscreen mode Exit fullscreen mode 
composer require package/name
Enter fullscreen mode Exit fullscreen mode 
composer dump-autoload
Enter fullscreen mode Exit fullscreen mode

The important distinction:

composer install
Enter fullscreen mode Exit fullscreen mode

is generally used to install the dependencies defined by the project.

Whereas:

composer update
Enter fullscreen mode Exit fullscreen mode

updates dependency versions according to the project's dependency constraints.

17. A Practical Troubleshooting Mindset

Here's the most important lesson.

Don't troubleshoot randomly.

Follow the request path.

If a website isn't working, think:

1. Does DNS resolve?
        ↓
2. Does the server respond?
        ↓
3. Is the web server running?
        ↓
4. Is port 80/443 reachable?
        ↓
5. Is TLS configured correctly?
        ↓
6. Is Nginx/Apache routing correctly?
        ↓
7. Is PHP-FPM running?
        ↓
8. Is the PHP application working?
        ↓
9. Can the application reach its database?
Enter fullscreen mode Exit fullscreen mode

This turns troubleshooting from guessing into a process.

Final Takeaway

DevOps isn't about memorizing hundreds of commands.

It's about understanding how systems connect.

DNS tells users where to go.

SSL/TLS protects the connection.

Nginx or Apache handles HTTP traffic.

PHP-FPM executes PHP workloads.

The application talks to its dependencies.

And Linux gives you the tools to inspect every layer.

If you understand that chain, troubleshooting becomes much easier.

Because instead of asking:

“Why is my website down?”

you start asking better questions:

“Where does the request fail?”

That's the mindset that turns a person who knows commands into an engineer who knows how systems work.

Quick Interview Revision

A vs CNAME?
A points to an IPv4 address. CNAME points to another domain name.

What does SPF do?
Defines authorized email senders for a domain.

What does DKIM do?
Provides a cryptographic signature for email authentication.

What does DMARC do?
Defines how receivers should handle SPF/DKIM authentication failures.

What is TLS?
A protocol used to secure network communication, including HTTPS.

What is PHP-FPM?
A process manager for PHP applications, commonly used with Nginx.

How do you check SSL expiry?

sudo certbot certificates
Enter fullscreen mode Exit fullscreen mode

or:

echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates
Enter fullscreen mode Exit fullscreen mode

How do you check DNS?

dig example.com
Enter fullscreen mode Exit fullscreen mode

How do you test certificate renewal?

sudo certbot renew --dry-run
Enter fullscreen mode Exit fullscreen mode

The biggest DevOps lesson?

Understand the request path. Troubleshoot the layer where the request actually fails.

Part 3: DNS, SSL Certificates & PHP Environments

3.1 DNS & Domain Configuration

DNS Record Types (MUST KNOW ALL)

Record Purpose Example
A Maps domain to IPv4 address example.com → 192.168.1.100
AAAA Maps domain to IPv6 address example.com → 2001:db8::1
CNAME Alias pointing to another domain www.example.com → example.com
MX Mail server for the domain example.com → mail.example.com (priority 10)
TXT Text records (SPF, DKIM, verification) v=spf1 include:_spf.google.com ~all
NS Nameservers for the domain example.com → ns1.digitalocean.com
SOA Start of Authority (primary NS, admin email) Auto-managed by DNS provider
PTR Reverse DNS (IP to domain) 192.168.1.100 → example.com
SRV Service location records Used for SIP, XMPP, etc.
CAA Certificate Authority Authorization Controls who can issue SSL for domain

SPF, DKIM & DMARC (Email Authentication - CRITICAL) 

# SPF (Sender Policy Framework) - TXT record
# Specifies which servers can send email for your domain
# Add as TXT record for @ (root domain):
v=spf1 ip4:192.168.1.100 include:_spf.google.com include:sendgrid.net ~all

# Explanation:
# v=spf1          - SPF version 1
# ip4:192.168.1.100 - Allow this IP to send mail
# include:_spf.google.com - Allow Google Workspace to send mail
# include:sendgrid.net - Allow SendGrid to send mail
# ~all            - Soft fail everything else (mark as suspicious)
# -all            - Hard fail everything else (reject)

# DKIM (DomainKeys Identified Mail) - TXT record
# Adds a digital signature to emails to verify they're not tampered
# Usually provided by your email service
# Add as TXT record for selector._domainkey.example.com:
# Name: google._domainkey
# Value: v=DKIM1; k=rsa; p=MIGfMA0GCS... (public key from provider)

# DMARC (Domain-based Message Authentication Reporting & Conformance) - TXT record
# Tells receivers what to do when SPF/DKIM fail
# Add as TXT record for _dmarc.example.com:
v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100

# Explanation:
# v=DMARC1        - DMARC version 1
# p=none          - Monitor only (start here)
# p=quarantine    - Send to spam if fails
# p=reject        - Reject email if fails
# rua=mailto:...  - Where to send aggregate reports
# pct=100         - Apply to 100% of emails
Enter fullscreen mode Exit fullscreen mode

DNS Troubleshooting Commands 

# Query DNS records
dig example.com                       # A record
dig example.com A                     # A record explicitly
dig example.com AAAA                  # IPv6
dig example.com MX                    # Mail records
dig example.com TXT                   # TXT records (SPF, DKIM)
dig example.com NS                    # Nameservers
dig example.com CNAME                 # CNAME records
dig example.com ANY                   # All records
dig +short example.com                # Short output
dig @8.8.8.8 example.com             # Query specific DNS server (Google)
dig @1.1.1.1 example.com             # Query Cloudflare DNS

# Alternative tools
nslookup example.com                  # Basic DNS lookup
nslookup -type=MX example.com         # MX records
host example.com                      # Simple DNS lookup

# Check DNS propagation
# Use online tools: dnschecker.org, whatsmydns.net

# Check PTR (reverse DNS)
dig -x 192.168.1.100

# Check current DNS cache
systemd-resolve --status              # systemd-resolved stats
systemd-resolve --flush-caches        # Flush DNS cache on Ubuntu

# Trace DNS resolution
dig +trace example.com                # Shows full DNS resolution path

# Check SPF record
dig TXT example.com | grep spf

# Check DKIM record
dig TXT google._domainkey.example.com

# Check DMARC record
dig TXT _dmarc.example.com
Enter fullscreen mode Exit fullscreen mode

Practical DNS Setup Scenarios 

# Scenario 1: Point domain to new server
# In DNS provider (Cloudflare/GoDaddy/Route53):
# Type: A    | Name: @   | Value: NEW_SERVER_IP  | TTL: 300
# Type: A    | Name: www | Value: NEW_SERVER_IP  | TTL: 300

# Scenario 2: Subdomain for staging
# Type: A    | Name: staging | Value: STAGING_SERVER_IP | TTL: 300

# Scenario 3: Setup Google Workspace email
# Type: MX   | Name: @   | Value: aspmx.l.google.com      | Priority: 1
# Type: MX   | Name: @   | Value: alt1.aspmx.l.google.com  | Priority: 5
# Type: MX   | Name: @   | Value: alt2.aspmx.l.google.com  | Priority: 5
# Type: TXT  | Name: @   | Value: v=spf1 include:_spf.google.com ~all

# Scenario 4: Cloudflare CDN setup
# Change nameservers to Cloudflare NS at domain registrar
# Cloudflare manages all DNS records after that
Enter fullscreen mode Exit fullscreen mode

Interview Q&A: DNS

Question Answer
What is DNS propagation? Time for DNS changes to spread globally (can take up to 48 hours, usually 15 min - 4 hours)
How to speed up DNS propagation? Lower TTL before making changes (e.g., 300 seconds), then change, then raise TTL back
A record vs CNAME? A maps to IP, CNAME maps to another domain name. Root domain (@) cannot have CNAME
What is TTL? Time To Live - how long DNS resolvers cache the record (in seconds)
What happens if MX records are wrong? Email for your domain won't be delivered
How to verify DNS changes? dig @8.8.8.8 example.com, use dnschecker.org, whatsmydns.net
What is reverse DNS? Maps IP to domain name (PTR record). Important for email delivery
Why is SPF important? Prevents email spoofing by specifying authorized mail servers
What does DKIM do? Adds cryptographic signature to emails proving they're not tampered
What does DMARC do? Tells receiving servers what to do when SPF/DKIM checks fail

3.2 SSL Certificate Management

Let's Encrypt (Free SSL - Most Common) 

# Install Certbot
sudo apt update
sudo apt install certbot

# For Apache
sudo apt install python3-certbot-apache
sudo certbot --apache -d example.com -d www.example.com

# For Nginx
sudo apt install python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com

# Standalone (when no web server is running)
sudo certbot certonly --standalone -d example.com

# Webroot (web server running, no plugin)
sudo certbot certonly --webroot -w /var/www/example.com/public -d example.com -d www.example.com

# Wildcard certificate (covers *.example.com)
sudo certbot certonly --manual --preferred-challenges dns -d "*.example.com" -d example.com
# This requires adding a TXT record to DNS

# Check certificate expiry
sudo certbot certificates

# Renew all certificates
sudo certbot renew

# Renew with dry run (test)
sudo certbot renew --dry-run

# Auto-renewal cron (usually set up automatically)
# Verify timer exists:
sudo systemctl status certbot.timer

# Or add to crontab:
0 0,12 * * * certbot renew --quiet --post-hook "systemctl reload nginx"
Enter fullscreen mode Exit fullscreen mode

Manual SSL Installation (Paid certificates) 

# SSL files you'll receive:
# 1. certificate.crt     - Your domain certificate
# 2. ca_bundle.crt        - Intermediate/CA bundle
# 3. private.key          - Private key (you generated this)

# Step 1: Generate CSR (Certificate Signing Request)
openssl req -new -newkey rsa:2048 -nodes -keyout example.com.key -out example.com.csr
# Fill in: Country, State, City, Org, Common Name (example.com)

# Step 2: Submit CSR to certificate provider (GoDaddy, DigiCert, Comodo, etc.)

# Step 3: Download and install certificates
sudo mkdir -p /etc/ssl/example.com
sudo cp example.com.crt /etc/ssl/example.com/
sudo cp ca_bundle.crt /etc/ssl/example.com/
sudo cp example.com.key /etc/ssl/example.com/
sudo chmod 600 /etc/ssl/example.com/example.com.key

# Step 4: Configure in Nginx
ssl_certificate /etc/ssl/example.com/example.com.crt;
ssl_certificate_key /etc/ssl/example.com/example.com.key;
# Note: you may need to combine cert + CA bundle:
cat example.com.crt ca_bundle.crt > fullchain.crt

# Step 4b: Configure in Apache
SSLCertificateFile /etc/ssl/example.com/example.com.crt
SSLCertificateKeyFile /etc/ssl/example.com/example.com.key
SSLCACertificateFile /etc/ssl/example.com/ca_bundle.crt
Enter fullscreen mode Exit fullscreen mode

SSL Troubleshooting 

# Check SSL certificate from command line
openssl s_client -connect example.com:443 -servername example.com

# Check certificate expiry date
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

# Check certificate details
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -text

# Verify certificate chain
openssl verify -CAfile ca_bundle.crt example.com.crt

# Check if private key matches certificate
openssl x509 -noout -modulus -in cert.crt | openssl md5
openssl rsa -noout -modulus -in private.key | openssl md5
# Both MD5 hashes should match!

# Online tools for SSL checking:
# ssllabs.com/ssltest
# sslshopper.com/ssl-checker.html
Enter fullscreen mode Exit fullscreen mode

Common SSL Issues & Fixes

Issue Cause Fix
ERR_CERT_HAS_EXPIRED Certificate expired Renew with certbot renew or get new cert
ERR_CERT_COMMON_NAME_INVALID Domain doesn't match cert Issue cert for correct domain name
Mixed content warnings HTTP resources on HTTPS page Update all URLs to HTTPS in code/DB
Certificate chain incomplete Missing intermediate cert Add CA bundle/intermediate certificate
SSL handshake failed Protocol/cipher mismatch Update ssl_protocols, check TLS version
Let's Encrypt rate limit Too many certs in short time Wait, use staging for testing

Interview Q&A: SSL

Question Answer
What is SSL/TLS? Encryption protocol securing data between browser and server. SSL is deprecated, TLS is current (1.2/1.3)
How does Let's Encrypt work? Free, automated CA. Validates domain ownership via HTTP challenge or DNS challenge, issues 90-day certs
How do you handle SSL renewal? Certbot auto-renewal via systemd timer or cron job, runs twice daily
What is a wildcard SSL? Covers all subdomains: *.example.com. Requires DNS challenge for Let's Encrypt
What is HSTS? HTTP Strict Transport Security. Forces browsers to always use HTTPS
What is a CSR? Certificate Signing Request. Contains public key + domain info, sent to CA to get certificate
How to troubleshoot "certificate not trusted"? Check chain is complete, intermediate certs included, cert matches domain
What's the difference between DV, OV, EV certs? DV: domain validation only. OV: org verified. EV: extended validation (green bar, most trust)

3.3 PHP Server Environment

PHP Installation & Management 

# Install PHP (with Apache)
sudo apt install php libapache2-mod-php

# Install PHP (with Nginx - uses PHP-FPM)
sudo apt install php-fpm php-cli

# Install specific PHP version
sudo add-apt-repository ppa:ondrej/php    # Add PHP repository
sudo apt update
sudo apt install php8.2-fpm php8.2-cli

# Install common PHP extensions
sudo apt install php8.2-mysql php8.2-pgsql php8.2-sqlite3  # Database
sudo apt install php8.2-curl php8.2-gd php8.2-mbstring     # Common
sudo apt install php8.2-xml php8.2-zip php8.2-intl         # Processing
sudo apt install php8.2-bcmath php8.2-soap php8.2-redis    # Additional
sudo apt install php8.2-imagick php8.2-opcache              # Performance

# Check PHP version
php -v

# List installed modules
php -m

# Find php.ini location
php --ini
php -i | grep "php.ini"

# Check specific PHP config
php -i | grep memory_limit
php -i | grep upload_max_filesize
Enter fullscreen mode Exit fullscreen mode

PHP Configuration (php.ini) 

# Find and edit php.ini
# For CLI:
sudo nano /etc/php/8.2/cli/php.ini
# For Apache:
sudo nano /etc/php/8.2/apache2/php.ini
# For FPM (Nginx):
sudo nano /etc/php/8.2/fpm/php.ini

# IMPORTANT settings to know:
memory_limit = 256M                    # Max memory per script
upload_max_filesize = 64M              # Max file upload size
post_max_size = 70M                    # Max POST data (must be > upload_max_filesize)
max_execution_time = 300               # Max script execution time (seconds)
max_input_time = 300                   # Max time to parse input
max_input_vars = 5000                  # Max input variables
date.timezone = Asia/Kolkata           # Timezone

# Error handling
display_errors = Off                   # NEVER On in production
log_errors = On                        # Always log errors
error_log = /var/log/php/error.log     # Error log path
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT

# Session settings
session.save_handler = files
session.save_path = "/var/lib/php/sessions"
session.gc_maxlifetime = 1440

# OPcache (Performance - MUST enable)
opcache.enable = 1
opcache.memory_consumption = 128
opcache.max_accelerated_files = 10000
opcache.revalidate_freq = 2

# After changes:
sudo systemctl restart php8.2-fpm     # For Nginx
sudo systemctl restart apache2         # For Apache
Enter fullscreen mode Exit fullscreen mode

PHP-FPM Configuration (for Nginx) 

# Pool config file
sudo nano /etc/php/8.2/fpm/pool.d/www.conf

# Key settings:
user = www-data
group = www-data
listen = /var/run/php/php8.2-fpm.sock  # Unix socket (preferred)
# OR
listen = 127.0.0.1:9000                # TCP socket

# Process manager settings
pm = dynamic                           # dynamic, static, or ondemand
pm.max_children = 50                   # Max worker processes
pm.start_servers = 5                   # Initial workers
pm.min_spare_servers = 5               # Min idle workers
pm.max_spare_servers = 35              # Max idle workers
pm.max_requests = 500                  # Requests before worker restart (prevents memory leaks)

# Status page (for monitoring)
pm.status_path = /php-fpm-status

# Slow log (for debugging)
slowlog = /var/log/php/slow.log
request_slowlog_timeout = 5s           # Log requests taking > 5s

# Restart PHP-FPM
sudo systemctl restart php8.2-fpm
sudo systemctl status php8.2-fpm
Enter fullscreen mode Exit fullscreen mode

Multiple PHP Versions 

# Install multiple versions
sudo apt install php7.4-fpm php8.0-fpm php8.1-fpm php8.2-fpm

# Switch CLI version
sudo update-alternatives --set php /usr/bin/php8.2
sudo update-alternatives --config php    # Interactive selection

# Use different PHP versions for different sites in Nginx:
# Site 1 (PHP 7.4):
location ~ \.php$ {
    fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
}

# Site 2 (PHP 8.2):
location ~ \.php$ {
    fastcgi_pass unix:/var/run/php/php8.2-fpm.sock;
}
Enter fullscreen mode Exit fullscreen mode

Composer (PHP Package Manager) 

# Install Composer
curl -sS https://getcomposer.org/installer | php
sudo mv composer.phar /usr/local/bin/composer

# Usage
composer install                       # Install dependencies from composer.json
composer update                        # Update dependencies
composer require package/name          # Add new package
composer dump-autoload                 # Regenerate autoloader
Enter fullscreen mode Exit fullscreen mode

Interview Q&A: PHP

Question Answer
What is PHP-FPM? FastCGI Process Manager. Manages PHP worker processes. Used with Nginx
Difference between mod_php and PHP-FPM? mod_php runs inside Apache (simpler). PHP-FPM is separate process (better performance, works with Nginx)
How to increase file upload limit? Change upload_max_filesize and post_max_size in php.ini, also client_max_body_size in Nginx
What is OPcache? Caches compiled PHP bytecode in memory, massive performance improvement
How to check which PHP extensions are installed? php -m or php -i
What causes a PHP memory limit error? Script needs more memory than memory_limit in php.ini. Increase it or optimize code
How to handle multiple PHP versions? Install via ondrej PPA, each version runs its own FPM pool, configure per-site in Nginx
Where do PHP errors go? Check error_log in php.ini, or /var/log/php/error.log, or site-specific error log
What is pm = dynamic vs static vs ondemand? Dynamic: scales workers within limits. Static: fixed workers. Ondemand: creates workers only when needed

Top comments (0)