I took it another step down to 

./configure --with-openssl
make clean && make

and still get the same error (even without the --with-kerberos).  

I read http://us4.php.net/function.fsockopen to indicate that --with-openssl is needed for full functionality of fsockopen in PHP 4.3.  At least that's what I'm guessing "if you have compiled in OpenSSL support" means.

It seems to me that the current configure script only checks kerberos in relation to IMAP (the kerberos checking code is inside the IMAP checking code).  However, OpenSSL also seems to require kerberos, at least in my install.  For this reason, I would like it if the --with-kerberos added the necessary -I/usr/kerberos/include regardless of whether --with-imap is included.  I am not sure how many others would be affected by this.

Red Hat has suggested configure.in (may need to be ext/openssl/config0.m4 in your case) script changes for this at https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=82369

Note:  if you want to duplicate this, you would first need to compile OpenSSL with Kerberos support.  

In the meantime, for anyone else who might encounter this problem, the indicated work around seems to be to run 

export CPPFLAGS="$CPPFLAGS -I/usr/kerberos/include"

before running make (at least the first time; if you run make multiple times, it should still be there; you can check with 

echo $CPPFLAGS

; it should return something that contains -I/usr/kerberos/include).

If you have openssl properly installed (if via some rpm, also the -devel rpm installed!) you should have it in pkg-config. What do these commands output for you:

# pkg-config --libs openssl

and

pkg-config --cflags-only-I openssl

# pkg-config --cflags-only-I openssl
pkg-config: command not found

Installing pkg-config does in fact fix this and allows compile.  Comparing the old config.cache file with the current config.cache file, I see that it did in fact note that pkg-config was not there.  However, it did not throw an error on not having pkg-config, just a comment "pkg-config: no."

I see three things that I would call workarounds:

1.  Install pkg-config, which handles the openssl requirements for you.  

2.  Manually exporting CPPFLAGS with the appropriate -I (or manually edit the makefile, but the export is probably better).

3.  Configure with --with-imap --with-kerberos, which will add the appropriate -I for you.  

I see two ways (there may be more) to implement solutions that avoid the workarounds above:

1.  In the configure script, move the code that handles --with-kerberos outside of the code that handles --with-imap.  Currently, combining the two will produce the required -I, so moving the code outside --with-imap should make it work.

2.  Throw an error when --with-openssl is used and pkg-config is not available.  If pkg-config is required to properly compile --with-openssl, then it should say so rather than waiting to throw an obscure compile error during make.  Ideally, the error should be overrideable, since pkg-config can be bypassed (see the three workarounds above).

2 might be needed to handle other situations where openssl relies on pkg-config to produce the correct library and header flags.  Further, 1 won't work with just --with-openssl but 2 will (tested).  Note that two still requires workaround #1 (install pkg-config) when encountered.  The difference is that it tells the user that.

Note:  as I have finished the install, I will no longer have access to this server (which won't throw the error now anyway) and will be unable to follow up with more testing.  You should be able to duplicate my previous situation with a 

cd PKG_CONFIG_DIR; mv pkg-config pkg-config-unavailable

for any followups you might need to do.

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.