Laravel HTTP Client ↔ System DNS Resolver: Inconsistent SSL Verification Behavior

Laravel HTTP Client and System DNS Resolver

The goal is to understand why SSL certificate validation sometimes fails when the Laravel HTTP Client resolves a host that has been cached by the underlying PHP‑FPM DNS resolver. The Laravel HTTP Client relies on Guzzle and ultimately cURL, which in turn uses the OS resolver and the CA bundle specified by curl.cainfo or openssl.cafile in php.ini. In a multi‑worker PHP‑FPM environment the resolver may cache DNS entries differently, leading to inconsistent host resolution and occasional “SSL certificate problem: unable to get local issuer certificate” errors.

Constraints include keeping SSL verification enabled in production, ensuring the CA bundle path is correct, and avoiding DNS‑related latency that can block worker processes. The uncertainty lies in whether the observed failures are due to DNS caching, a misconfigured CA bundle, or a subtle interaction between Guzzle’s withoutVerifying() method and PHP‑FPM’s resolver.

Questions:

• What specific conditions cause the Laravel HTTP Client to ignore a correctly configured CA bundle when DNS resolution is cached by PHP‑FPM?
• Does setting curl.cainfo in php.ini guarantee consistent SSL verification across all PHP‑FPM workers, or is per‑worker configuration required?
• Is there a documented way to disable DNS caching in PHP‑FPM to prevent resolution delays without impacting SSL validation?