PECL TLS 1.3 seems to be broken

I can't reach it at all and neither can my colleagues. I'm on Linux, they are on Windows.
Even pointing a browser at the website fails now.

If I run curl and force the max TLS to be 1.2, it works.

$ openssl s_client -connect pecl.php.net:443 -servername pecl.php.net -tls1_3 
Connecting to 180.149.231.175
CONNECTED(00000003)
801747BD3C740000:error:0A000126:SSL routines::unexpected eof while reading:../ssl/record/rec_layer_s3.c:698:
---
no peer certificate available
---
No client certificate CA names sent
Negotiated TLS1.3 group: <NULL>
---
SSL handshake has read 0 bytes and written 1488 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Protocol: TLSv1.3
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

$ openssl s_client -connect pecl.php.net:443 -servername pecl.php.net -tls1_2
Connecting to 180.149.231.175
CONNECTED(00000003)
depth=3 C=US, O=Internet Security Research Group, CN=ISRG Root X2
verify return:1
depth=2 C=US, O=ISRG, CN=Root YE
verify return:1
depth=1 C=US, O=Let's Encrypt, CN=YE2
verify return:1
depth=0 CN=pecl.php.net
verify return:1
---
Certificate chain
 0 s:CN=pecl.php.net
   i:C=US, O=Let's Encrypt, CN=YE2
   a:PKEY: EC, (prime256v1); sigalg: ecdsa-with-SHA384
   v:NotBefore: Jul  6 12:03:52 2026 GMT; NotAfter: Oct  4 12:03:51 2026 GMT
 1 s:C=US, O=Let's Encrypt, CN=YE2
   i:C=US, O=ISRG, CN=Root YE
   a:PKEY: EC, (secp384r1); sigalg: ecdsa-with-SHA384
   v:NotBefore: Sep  3 00:00:00 2025 GMT; NotAfter: Sep  2 23:59:59 2028 GMT
 2 s:C=US, O=ISRG, CN=Root YE
   i:C=US, O=Internet Security Research Group, CN=ISRG Root X2
   a:PKEY: EC, (secp384r1); sigalg: ecdsa-with-SHA384
   v:NotBefore: May 13 00:00:00 2026 GMT; NotAfter: Sep  2 23:59:59 2032 GMT
 3 s:C=US, O=Internet Security Research Group, CN=ISRG Root X2
   i:C=US, O=Internet Security Research Group, CN=ISRG Root X1
   a:PKEY: EC, (secp384r1); sigalg: sha256WithRSAEncryption
   v:NotBefore: May 13 00:00:00 2026 GMT; NotAfter: Sep  2 23:59:59 2032 GMT
 4 s:C=US, O=Internet Security Research Group, CN=ISRG Root X1
   i:C=US, O=Internet Security Research Group, CN=ISRG Root X1
   a:PKEY: RSA, 4096 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Jun  4 11:04:38 2015 GMT; NotAfter: Jun  4 11:04:38 2035 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDfzCCAwWgAwIBAgISBcHLoPMD8Qs4ewCmaMAF9vhrMAoGCCqGSM49BAMDMDMx
CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZ
RTIwHhcNMjYwNzA2MTIwMzUyWhcNMjYxMDA0MTIwMzUxWjAXMRUwEwYDVQQDEwxw
ZWNsLnBocC5uZXQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAS3jjbxx4uLCoiv
9/mcY0WKft6Auh0UqX9fI8Lm95EtcO6zOZYEsnDuegck8bntHigVbbAD3VA7v/tU
po0KFgLuo4ICEzCCAg8wDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUF
BwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFHuWr8SZzb6cG3kCweRgd52CqQ5Q
MB8GA1UdIwQYMBaAFLlZ8o7PIvCG0zdI/3YUGLqC2FWHMDMGCCsGAQUFBwEBBCcw
JTAjBggrBgEFBQcwAoYXaHR0cDovL3llMi5pLmxlbmNyLm9yZy8wFwYDVR0RBBAw
DoIMcGVjbC5waHAubmV0MBMGA1UdIAQMMAowCAYGZ4EMAQIBMC8GA1UdHwQoMCYw
JKAioCCGHmh0dHA6Ly95ZTIuYy5sZW5jci5vcmcvMTA4LmNybDCCAQQGCisGAQQB
1nkCBAIEgfUEgfIA8AB2ANdtfRDRp/V3wsfpX9cAv/mCyTNaZeHQswFzF8DIxWl3
AAABnzeFyxcAAAQDAEcwRQIhALZHrDxKz79nB+fhqlE/9OYSPgTmicDcOKo8Y/QW
44ZAAiAjhQ0BZSX7on12Y1XWw352jTVDWUM5xWhGBaMcdcX74QB2AMs49xWJfISh
RF9bwd37yW7ymlnNRwppBYWwyxTDFFjnAAABnzeF0t4AAAQDAEcwRQIgYYEjeXdb
8v4wMQ17jSHc3hGrAtQ6Y+uVGlD9qUp8/aMCIQDOzZYwNVD/jz1JQb/4ZHjAsp9r
s52MaZ5fIt/tGZ8PzzAKBggqhkjOPQQDAwNoADBlAjBJ39PKRIrdGpI63L18Urhm
+sh2eLVDw28sHMW3IfYO9VeVqnhvgOtKtKTaB7RhInACMQCT4vGCnGurcidIL/Mj
yKSIyNXa3JUzlcaYWF17nzoCL5D8EpnMSHOtv34JawsiTP0=
-----END CERTIFICATE-----
subject=CN=pecl.php.net
issuer=C=US, O=Let's Encrypt, CN=YE2
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: ecdsa_secp256r1_sha256
Peer Temp Key: X25519, 253 bits
---
SSL handshake has read 5270 bytes and written 305 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-ECDSA-AES256-GCM-SHA384
Protocol: TLSv1.2
Server public key is 256 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-ECDSA-AES256-GCM-SHA384
    Session-ID: 252FC1500072483F9CF0F983455F23FA157E216AC5D4DB984A70F0C72DF39D8D
    Session-ID-ctx: 
    Master-Key: 0DA59F4CCBD9C73E90DD716FEF84F7B4C60EFC5394E59BD463D51F103F326058F94A3B2C8AE0B1794AF065230216FA09
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 43200 (seconds)
    TLS session ticket:
    0000 - fa ff 72 71 c4 bd 2b 02-d1 94 5a db 6a ee fc 01   ..rq..+...Z.j...
    0010 - 0a e3 03 90 87 cd db e7-eb 83 36 46 b8 2c 12 8e   ..........6F.,..
    0020 - fb 17 0f bb 7b 1b 95 55-c8 7f e4 6a f0 2b fd a5   ....{..U...j.+..
    0030 - ff d6 2c e8 4f 6f 71 bc-11 ff a1 a5 78 c8 7e f8   ..,.Ooq.....x.~.
    0040 - 5b 96 19 8b 4e 02 25 93-19 fd e7 60 8b cf aa 67   [...N.%....`...g
    0050 - fe 38 fd dd 64 e9 b6 98-dc 34 e5 49 96 0d 10 da   .8..d....4.I....
    0060 - eb 87 c4 45 09 6a 04 0e-28 ea 06 21 f0 e2 10 57   ...E.j..(..!...W
    0070 - de cb ef b7 80 c7 a1 11-7c bb 0d e6 e4 42 69 35   ........|....Bi5
    0080 - d4 95 65 76 d7 83 70 07-95 c4 fa 64 0c 2c 60 39   ..ev..p....d.,`9
    0090 - 91 f5 cc 63 be 4c cd 7f-24 76 7b d2 99 a4 3a 3c   ...c.L..$v{...:<
    00a0 - 04 26 c2 f3 6a 74 7a d0-30 6b 94 f5 f1 7b 60 eb   .&..jtz.0k...{`.
    00b0 - fb 63 99 ce 7f 42 47 51-c0 b3 c9 98 8b 64 e2 47   .c...BGQ.....d.G
    00c0 - c3 36 82 4b 22 fc 40 12-da 3a 11 9b 70 ee bd bd   .6.K".@..:..p...

    Start Time: 1785874354
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: yes
---
closed

Start by reproducing the failure against pecl.php.net with the shown openssl s_client commands, comparing TLS 1.3 and TLS 1.2. Investigate the PECL website's TLS endpoint configuration; done means browsers and TLS 1.3 clients can connect successfully while TLS 1.2 remains functional.