PHP cURL error 60

Question

Yes I've seen the many questions about this, in fact I already had this problem and solved it last year. This time for some reason the solution (adding https://curl.haxx.se/ca/cacert.pem) doesn't work.

The server (my company's) is a node.js app, I registered the server private key, server crt, and the root and intermediate certificates (I think?), the names are DigiCertCA.crt and TrustedRoot.crt. The client is a PHP script making a cURL connection. It had been working fine after I added cacert.pem to php.ini. Recently my company renewed the SSL certificates, and around the same time the client PHP script (another company's) was moved to a production server from dev. Then the SSL broke again.

The website looks fine when opened with chrome (secure https, not broken). Here is the PHP script, simplified to demonstrate the problem. I tried adding the cacert.pem both through php.ini and curl_setopt, with no success. This is running on my local development machine, Windows 10 with xampp 5.6.3

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://example.com'); 
curl_setopt($ch, CURLOPT_CAINFO, 'D:/xampp/php/extras/ssl/cacert.pem');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_TIMEOUT, 3);
$content = trim(curl_exec($ch));
if (curl_errno($ch)) {
    $content = 'ERROR -> ' . curl_errno($ch) . ': ' . curl_error($ch);
} 
curl_close($ch);
print $content;

Error message:

60: SSL certificate problem: unable to get local issuer certificate

Additional info:

The error message for the production PHP script is different actually, there it says

curl: (60) Peer's Certificate issuer is not recognized.

I also tried using curl to access other subdomains using my company's certificates and they all give the same error 60. While accessing https://twitter.com is OK

Possible duplicate of [cURL error 60: SSL certificate: unable to get local issuer certificate](https://stackoverflow.com/questions/29822686/curl-error-60-ssl-certificate-unable-to-get-local-issuer-certificate) — Pankaj Makwana, Jul 27 '17 at 07:34
@Alive to Die Not an option, I don't want to turn off verifypeer as that would make https useless — iceman2992, Jul 27 '17 at 07:40
@PankajMakwana I've tried that, as I stated in my question, doesn't work for me — iceman2992, Jul 27 '17 at 07:40

score 0 · Answer 1 · edited Jul 27 '17 at 09:45

0

you have a mistake I think

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

you have kept this true, so it seems to be the issue

edited Jul 27 '17 at 09:45

Alive to die - Anant

70,531
10
51
98

answered Jul 27 '17 at 07:36

Dhaval Chheda

4,637
5
24
44

1

That does not solve my problem at all, it just turns off cert verification – iceman2992 Jul 27 '17 at 07:39
what happens when you remove curl_setopt($ch, CURLOPT_CAINFO, 'D:/xampp/php/extras/ssl/cacert.pem'); from the code? – Dhaval Chheda Jul 27 '17 at 07:52
Nothing, same error 60 as before, I've added additional info to my question – iceman2992 Jul 27 '17 at 07:53
I hope you are not trying to curl https://example.com as the domain does not exist with the ssl – Dhaval Chheda Jul 27 '17 at 08:35
No no, that's just a placeholder, I curl my company web server, but I don't think they'd be pleased if I write the url here – iceman2992 Jul 27 '17 at 08:46
what happens when you directly hit that url? you get the output? – Dhaval Chheda Jul 27 '17 at 09:03
With browser - OK; With powershell curl - OK; With PHP curl - ERROR – iceman2992 Jul 27 '17 at 09:07

PHP cURL error 60

1 Answers1