I'm trying to write some code to fetch pages either via HTTP or HTTPS.
<?php
$ch = curl_init('https://www.google.com');
// <START OPTIONS>
// Uncomment the following line to "fix" error 60: "SSL certificate problem: unable to get local issuer certificate"
//curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
// These options make no difference
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, CURLOPT_CAINFO, 'C:/server/cacert.pem');
// This changes error 60 to error 58: "unable to set private key file: 'C:/server/cacert.pem' type PEM"
curl_setopt($ch, CURLOPT_SSLCERT, 'C:/server/cacert.pem');
// <END OPTIONS>
if (curl_exec($ch) === false) {
var_dump(curl_errno($ch), curl_error($ch));
}
curl_close($ch);
I've followed the advice in this answer about adding a cacert.pem file to php.ini, but I'm still getting error 60. I believe this is what the CURLOPT_CAINFO option does too.
If I include curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); it works, but only by bypassing the security checks.
cURL settings from php -i:
curl
cURL support => enabled
cURL Information => 7.42.1
Age => 3
Features
AsynchDNS => Yes
Debug => No
GSS-Negotiate => No
IDN => No
IPv6 => Yes
Largefile => Yes
NTLM => Yes
SPNEGO => Yes
SSL => Yes
SSPI => Yes
krb4 => No
libz => Yes
CharConv => No
Protocols => dict, file, ftp, ftps, gopher, http, https, imap, imaps, ldap, pop3, pop3s, rtsp, scp, sftp, smtp, smtps, telnet, tftp
Host => i386-pc-win32
SSL Version => OpenSSL/0.9.8zf
ZLib Version => 1.2.7
libSSH Version => libssh2/1.5.0
cURL settings from phpinfo():
curl
cURL support enabled
cURL Information 7.42.1
Age 3
Features
AsynchDNS Yes
Debug No
GSS-Negotiate No
IDN No
IPv6 Yes
Largefile Yes
NTLM Yes
SPNEGO Yes
SSL Yes
SSPI Yes
krb4 No
libz Yes
CharConv No
Protocols dict, file, ftp, ftps, gopher, http, https, imap, imaps, ldap, pop3, pop3s, rtsp, scp, sftp, smtp, smtps, telnet, tftp
Host i386-pc-win32
SSL Version OpenSSL/1.0.1e
ZLib Version 1.2.7
libSSH Version libssh2/1.5.0
The settings are identical except for SSL Version => OpenSSL/0.9.8zf (CLI) SSL Version OpenSSL/1.0.1e (CGI)
My development machine is Windows XP, PHP 5.4.45 but when I get it working I'll want to transfer it to a Linux server.
Do I need to configure php.ini differently or use different cURL options? How can I get cURL to succeed only if the site is correctly signed, i.e. with curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);?
