1

I'm using Rackspace API in PHP, and it just stopped working (everything worked fine 3 days ago). It uses guzzle, who uses curl. And curl just stopped working.

[Thu Jun 21 14:55:36 2018] [error] [client xxx.xx.xxx.xx] PHP Fatal error:  Uncaught exception 'Guzzle\\Http\\Exception\\CurlException' with message '[curl] 60:  [url] https://identity.api.rackspacecloud.com/v2.0/tokens' in 

/var/www/passline.com/vendor/guzzle/http/Guzzle/Http/Curl/CurlMulti.php:359\nStack trace:\n#0

/var/www/passline.com/vendor/guzzle/http/Guzzle/Http/Curl/CurlMulti.php(292): Guzzle\\Http\\Curl\\CurlMulti->isCurlException(Object(Guzzle\\Http\\Message\\EntityEnclosingRequest), Object(Guzzle\\Http\\Curl\\CurlHandle), Array)\n#1    

/var/www/passline.com/vendor/guzzle/http/Guzzle/Http/Curl/CurlMulti.php(257): Guzzle\\Http\\Curl\\CurlMulti->processResponse(Object(Guzzle\\Http\\Message\\EntityEnclosingRequest), 
Object(Guzzle\\Http\\Curl\\CurlHandle), Array)\n#2     

/var/www/passline.com/vendor/guzzle/http/Guzzle/Http/Curl/CurlMulti.php(240): Guzzle\\Http\\Curl\\CurlMulti->processMessages()\n#3    

/var/www/passline.com/vendor/guzzle/http/Guzzle/Http/Curl/CurlMulti.php(224): Guzzle\\Http\\Curl\\CurlMulti->executeHandles()\n#4

/var/www/passline.com/vendor/guzzle/http/Guzzle/Http/Curl/CurlMulti.php(111)

The important part from the error is the following:

[curl] 60: [url] https://identity.api.rackspacecloud.com/v2.0/tokens

I get an error 60 from Curl, who means is an SSL cert error. Most answer say's the solution to this problem is: deactivate ssl or download a new cert.

curl: (60) SSL certificate : unable to get local issuer certificate

https://es.stackoverflow.com/questions/174276/curl-60-ssl-certificate-problem-unable-to-get-local-issuer-certificate-url-h

I won't deactivate SSL, I can't use http instead of https and I want to avoid having to get into the machine and downloading a new cert.

If someday I have an old cert again, my site is going to stop working. What is the correct way to fix this?

This server has CenOs 6, We're using PHP 5.3.3 and curl 7.19.7

---- Edit ----

So, my problem is because of the change in the certificates of curl. From https://curl.haxx.se/docs/caextract.html

This bundle was generated at Wed Jun 20 03:12:06 2018 GMT .

There is a tool on linux called update-ca-certificates who solves this problem, also, the curl site say's you can run

curl --remote-name --time-cond cacert.pem https://curl.haxx.se/ca/cacert.pem

But, I don't know, someday I'll see the system stop working properly, I gonna get into the machine an run this command, and, that's all?, What doest the other people do?, set a cron with this command? or what?

lcjury
  • 1,158
  • 1
  • 14
  • 26
  • 1
    1) you are offtopic here since it is not a programming question (so look on [su] or [sf] or [Webmasters.se] instead) but more important 2) "I Get an error 60 with Curl. " is not providing any useful information.... show the curl command you use in full, and the result in full. And despite what you can read, "deactivate SSL(sic)" is **never** good idea. You might as well do HTTP queries then instead of HTTPS, as authentication of remote is more important than transport confidentiality. – Patrick Mevzek Jun 21 '18 at 16:34
  • I don't own the code, so I can't show the code I'm using. (I just use an rackspace lib who use guzzle who use curl). the result is just that "curl error 60". I won't deactivate SSL, that's the reason why I'm asking I cant do http query, I don't own the code I don't know if curl download the cert by himself, or how all of this work. Are you sure this belongs to Server Fault?, I prefer to avoid doing stuffs in the server. – lcjury Jun 21 '18 at 16:49
  • You should at least give the URL you are trying to reach... Things may alo depend on the PHP version, the openssl version, the curl version, the API version, the OS type and version... You give no data points. Otherwise you will get only generic replies that may or may not resolve your problem. And your question is not really related to programming... – Patrick Mevzek Jun 21 '18 at 17:10
  • Thanks for your help Patrick, tried to add most of the request info to the question. Should I change something else? – lcjury Jun 21 '18 at 17:31
  • 1
    Thank you so much @lcjury this saved me today... – w3bMak3r May 15 '20 at 23:33

3 Answers3

2

Older versions of Guzzle made use of their own CA file that was bundled with the Guzzle library. It would use that file instead of system's (/etc/pki/tls/certs).

If you can get things working with cURL from the command line but get this error in Guzzle that is likely the culprit.

Things were changed to use the system CA bundle by default in late 2014.

https://github.com/guzzle/guzzle/issues/623

https://github.com/guzzle/guzzle/pull/800

The behaviour of newer (> 3.0 ?) versions is described here (see verify configuration flag):

  1. Check if openssl.cafile is set in your php.ini file.
  2. Check if curl.cainfo is set in your php.ini file.
  3. Check if /etc/pki/tls/certs/ca-bundle.crt exists (Red Hat, CentOS, Fedora; provided by the ca-certificates package)
  4. Check if /etc/ssl/certs/ca-certificates.crt exists (Ubuntu, Debian; provided by the ca-certificates package)
  5. Check if /usr/local/share/certs/ca-root-nss.crt exists (FreeBSD; provided by the ca_root_nss package)
  6. Check if /usr/local/etc/openssl/cert.pem (OS X; provided by homebrew)
  7. Check if C:\windows\system32\curl-ca-bundle.crt exists (Windows)
  8. Check if C:\windows\curl-ca-bundle.crt exists (Windows)
ficuscr
  • 6,975
  • 2
  • 32
  • 52
  • Wow, this is a nice tip, but I think this doesn't solve my question – lcjury Jun 27 '18 at 17:49
  • In theory the CA would be updated by the system (`ca-certificates` RPM). Negating the need for you to manually update from `curl.haxx.se`. The approach of using a static file in the code repository was flawed. Not sure if specifically your issue, hope answer helps others. – ficuscr Jun 27 '18 at 17:52
  • The system update the certificates itself?. I'm using guzzle 3.9, so, it comes with the pull-request you linked – lcjury Jun 27 '18 at 17:55
  • Yes. RHEL and clones should be doing that with `ca-certificates` package. If for some reason you were not getting updates then you can do it manually. [More here](https://serverfault.com/questions/394815/how-to-update-curl-ca-bundle-on-redhat) – ficuscr Jun 27 '18 at 17:59
  • That's strange. I had to manually run `update-ca-certificates` to fix my problem. Anyway is good to know that, it should do it automatically – lcjury Jun 27 '18 at 18:00
1

If someday I have an old cert again, my site is going to stop working. Curl should download a new cert by himself? isn't it?.

The concept of TLS is that the server sends its certificate to the client, shows a prove that it actually owns the private key belonging to the certificate and then the client checks if the certificate is considered trusted. Trusted means among others that the certificate was issued by a locally trusted CA (certificate authority).

Typically the client has a set of CA it trusts, i.e. CA like Let's Encrypt. If the certificate was issued by such an already trusted CA no changes to the client are needed whenever the certificate is changed as long as the issuer CA is still trusted and the server is configured properly to provide all intermediate CA certificates which are needed to build the trust path.

If instead you have a self-signed certificate or a certificate signed by some private CA the client has no kind of trust anchor it can use to verify the certificate. In this you need to provide the necessary trust anchor to the client. In case of a private CA it is sufficient to setup the client once with this private CA and it will accept also later certificates issued by this CA. But in case of a self-signed certificate this means that you need to update the expected certificate at the client whenever you update the certificate at the server. There is no automatic way to do it - because how should the client verify that it gets the correct new certificate without having an established trust to the party providing the new certificate?

Steffen Ullrich
  • 114,247
  • 10
  • 131
  • 172
0

This issue was caused by the change in the certificates of curl. From https://curl.haxx.se/docs/caextract.html

This bundle was generated at Wed Jun 20 03:12:06 2018 GMT .

There is a tool on linux called update-ca-certificates who solves this problem, also, the curl site say's you can run

curl --remote-name --time-cond cacert.pem https://curl.haxx.se/ca/cacert.pem

Just consider any of these commands may be needed to run again in the future if the certificates are renovated again.

lcjury
  • 1,158
  • 1
  • 14
  • 26