I would like to keep my root certificates current for use with cURL and PHP's internal curl command, however there is no parameter currently to download the current file it requires for a proper secure connection and to keep it current.
And example of using curl in PHP for a secure connection which requires a file named cacert.pem (PEM encoded certificate chain for validating remote connections) is as follows :
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://www.google.com");
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 15);
curl_setopt($ch, CURLOPT_TIMEOUT, 15);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 1);
curl_setopt($ch, CURLOPT_CAINFO, "pathto/cacert.pem");
curl_setopt($ch, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
if (!($data = curl_exec($ch))) {
echo "No data received";
} else {
echo strlen($data) + " total byte(s)";
}
curl_close($ch);
While most people simply set CURLOPT_SSL_VERIFYPEER to false, and thus ignore the problem, which is bad . You can see here where a certificate authority shows that if you do not have this file current, the only way to connect to a secure server is to disable certificate checking and further warns of the implications behind disabling peer verification.
What I am requesting is for a legitimate way to maintain a local copy of cacert.pem so that when I use curl in PHP to communicate with other servers, I can continue to do so securely .
This is not a request for an external resource or off-site link etc, however due to the nature of the problem, it is likely that may be the ONLY way to resolve this as it would require continuous updating as certificate chains are revoked. To date, there is no way to obtain this file either as part of the distribution of curl itself, or php, or the curl library for php and continue to maintain it. While it is discouraging that this is not something which a simple update command like curl --update-root-ca would be nice, it does not exist in any form.
