0

I'm trying to have a server A communicate with a server B through HTTPS requests. Server B has a certificate that was issued to me by my employer, and connecting to it through both Safari and Chrome works without any issues.

However, when trying to send a request from A to B through Guzzle, I get the following error:

GuzzleHttp/Exception/RequestException with message 'cURL error 60: SSL certificate problem: 
unable to get local issuer certificate (see https://curl.haxx.se/libcurl/c/libcurl-errors.html)'

I've tried setting the cert file as a parameter ( [verify => '/path/to/cert.pem'] ), but, first of all, I only had .crt, .csr and .key files; I tried making a .pem file through these instructions I found somewhere else:

(optional) Remove the password from the Private Key by following the steps listed below:
openssl rsa -in server.key -out nopassword.key
Note: Enter the pass phrase of the Private Key.

Combine the private key, public certificate and any 3rd party intermediate certificate files:
cat nopassword.key > server.pem
cat server.crt >> server.pem
Note: Repeat this step as needed for third-party certificate chain files, bundles, etc:
cat intermediate.crt >> server.pem

This didn't work – the error's the same. The request works with 'verify' set to false, but that's obviously not an option for production.

Certificates are not something I usually work with, so I'm having a lot of trouble just figuring out where the issue might lie, let alone fix it. Any help would be much appreciated.

Edit I've also tried the solutions suggested in Guzzle Curl Error 60 SSL unable to get local issuer to no avail.

sakinobashi
  • 197
  • 2
  • 11

1 Answers1

0

This was happening because the only certificate I had configured on server B was the End User certificate.

I'm new to this, so my explanation will probably be flawed, but from my understanding End User certificates link back to a trusted Certificate Authority (CA) certificate, with zero or more intermediate certificates in-between. Browsers can figure out this certificate chain, and download the required certificates that are missing; cURL does not.

Therefore, the solution was configuring Server B with the missing certificates. How to do this is a whole different issue, so I won't go into it in this answer.

sakinobashi
  • 197
  • 2
  • 11