Ошибка curl ssl certificate problem unable to get local issuer certificate

For WAMP, this is what finally worked for me.
While it is similar to others, the solutions mentioned on this page, and other locations on the web did not work. Some «minor» detail differed.
Either the location to save the PEM file mattered, but was not specified clearly enough.
Or WHICH php.ini file to be edited was incorrect. Or both.
I’m running a 2020 installation of WAMP 3.2.0 on a Windows 10 machine.

Link to get the pem file:

http://curl.haxx.se/ca/cacert.pem
Copy the entire page and save it as: cacert.pem, in the location mentioned below.

Save the PEM file in this location

<wamp install directory>binphpphp<version>extrasssl
eg saved file and path: «T:wamp64binphpphp7.3.12extrassslcacert.pem»

*(I had originally saved it elsewhere (and indicated the saved location in the php.ini file, but that did not work).
There might, or might not be, other locations also work. This was the recommended location — I do not know why.)

WHERE
<wamp install directory> = path to your WAMP installation.
eg: T:wamp64

<php version> of php that WAMP is running: (to find out, goto: WAMP icon tray -> PHP <version number>
if the version number shown is 7.3.12, then the directory would be: php7.3.12)
eg: php7.3.12

Which php.ini file to edit

To open the proper php.ini file for editing, goto: WAMP icon tray -> PHP -> php.ini.
eg: T:wamp64binapacheapache2.4.41binphp.ini
NOTE: it is NOT the file in the php directory!

Update:
While it looked like I was editing the file: T:wamp64binapacheapache2.4.41binphp.ini,
it was actually editing that file’s symlink target: T:/wamp64/bin/php/php7.3.12/phpForApache.ini.

Note that if you follow the above directions, you are NOT editing a php.ini file directly. You are actually editing a phpForApache.ini file. (a post with info about symlinks)

If you read the comments at the top of some of the php.ini files in various WAMP directories, it specifically states to NOT EDIT that particular file.
Make sure that the file you do open for editing does not include this warning.

Installing the extension Link Shell Extension allowed me to see the target of the symlink in the file Properites window, via an added tab. here is an SO answer of mine with more info about this extension.

If you run various versions of php at various times, you may need to save the PEM file in each relevant php directory.

The edits to make in your php.ini file:

Paste the path to your PEM file in the following locations.

• uncomment ;curl.cainfo = and paste in the path to your PEM file.
  eg: curl.cainfo = "T:wamp64binphpphp7.3.12extrassslcacert.pem"

• uncomment ;openssl.cafile= and paste in the path to your PEM file.
  eg: openssl.cafile="T:wamp64binphpphp7.3.12extrassslcacert.pem"

Credits:

While not an official resource, here is a link back to the YouTube video that got the last of the details straightened out for me: https://www.youtube.com/watch?v=Fn1V4yQNgLs.

If you are using PHP’s cURL functions to connect to an HTTPS URL, then you might come across the following error:

SSL certificate problem: unable to get local issuer certificate.  (cURL error code 60)

This is a common error that occurs whenever you attempt to use cURL functions to connect to an HTTPS website.

In plain English, it means that you have not configured cURL to connect to SSL-enabled websites.

The quick fix.

If you do not care about security and are looking for a quick fix, then you can simply disable the following cURL options:

• CURLOPT_SSL_VERIFYHOST: This option tells cURL that it must verify the host name in the server cert.
• CURLOPT_SSL_VERIFYPEER: This option tells cURL to verify the authenticity of the SSL cert on the server.

Disabling these two options disables SSL verification.

To disable these two options, you can use the curl_setopt function like so:

//The URL we are connecting to.
$url = 'https://google.com';

//Initiate cURL.
$ch = curl_init($url);

//Disable CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER by
//setting them to false.
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

//Execute the request.
curl_exec($ch);

//Check for errors.
if(curl_errno($ch)){
    throw new Exception(curl_error($ch));
}

The PHP code above essentially tells cURL that we don’t care if the server has a valid SSL cert or not. We want to connect to it anyway.

The problem with this method is that it is insecure and it leaves you open to man-in-the-middle attacks. Simply put, this means that an attacker could potentially intercept the data that you are sending in your cURL requests.

Using a cert with PHP’s cURL functions.

To use a certificate with PHP’s cURL functions, you can download the cacert.pem certificate bundle from the official cURL website.

Once you have downloaded the cacert.pem file, you should move it to whatever directory makes the most sense for you and your setup.

For example, on Windows, I moved my bundle to C:wampcacert.pem

Then, you can simply tell cURL where your certificate bundle is located by using the curl_setopt function:

//Tell cURL where our certificate bundle is located.
$certificate = "C:wampcacert.pem";
curl_setopt($ch, CURLOPT_CAINFO, $certificate);
curl_setopt($ch, CURLOPT_CAPATH, $certificate);

This allows us to make a secure request to the server and prevent any man-in-the-middle attacks.

Adding the cert to your php.ini file.

If you don’t like the thought of having to specify the location of the certificate bundle in your PHP code, then you can add its path information to your php.ini file like so:

curl.cainfo="C:wampcacert.pem" 
openssl.cafile="C:wampcacert.pem"

Once you add the above lines to your php.ini file, make sure that you reload the web server / PHP process so that the changes take effect.

Enabling mod_ssl and php_openssl.dll.

If you are using Apache and PHP on Windows, then you might need to enable both mod_ssl and php_openssl.dll.

To enable mod_ssl, you can add the following to your Apache configuration file:

LoadModule ssl_module /usr/lib/httpd/modules/mod_ssl.so

The configuration line above presumes that a file called mod_ssl.so exists in a Linux directory called “/usr/lib/httpd/modules/”.

On Windows, this directory might be something like “C:wampbinapacheapache2.4.9modules“.

You will need to change this line to match your own Apache setup.

To enable php_openssl.dll, you will need to uncomment the following line in your php.ini file:

extension=php_openssl.dll

As always, you should test your configurations and then reload your server for any changes to take effect.

Quick step by step to fix SSL certificate problem: Unable to get local issuer certificate error.

Have you experienced the ‘SSL certificate problem unable: to get local issuer certificate’ problem while attempting to move from HTTP to HTTPS? We know how overwhelming it can be to deal with this issue but don’t let that frighten you. Here, we can help you fix it with this piece of writing and don’t make the wrong decisions like uninstalling your SSL certificate.

Regardless of which error pops up or the complexities involved in fixing it, never uninstall your SSL Certificate to get rid of SSL errors as doing that could prove to be fatal and expose you to serious security risks. Always remember that your SSL certificate protects the communication exchanged between the server and the browser, which prevents data interception of a third party.

Even, data privacy laws are getting stricter by the day, and therefore, you cannot make the unwise decision to uninstall your SSL. So, your only option is to get to the bottom of the ‘unable to get local issuer certificate’ error and fix it.

Before we help you do that, let us figure out how an SSL Certificate works and why it shows up the ‘curl: (60) SSL certificate problem: unable to get local issuer certificate’ or the ‘git SSL certificate problem unable to get local issuer certificate’ errors.

Why SSL Certificate Problem: Unable to get Local Issuer Certificate Error Happen?

Your SSL certificate’s primary purpose is to confirm authentication and ensure a secure exchange of information between the server and the client by referring to the HTTPS protocol. That is only possible when you have a working root certificate that is either directly or indirectly signed by a Certificate Authority. However, the error unable to get local issuer certificate’ occurs when the root certificate is not working properly especially when an SSL client makes an HTTPS request and during this, the client has to share an SSL certificate for identity verification.

Therefore, you need to take the necessary actions required to help bridge the gap.

How to Fix SSL Certificate Problem: Unable to get Local Issuer Certificate?

Now that we know the reasons for the ‘unable to get local issuer certificate’ glitch, it’s time to act. You could be experiencing this glitch due to many reasons, and those reasons could vary from software interfering in the SSL/TSL session or your Git application. Once you identify the cause, it becomes a whole lot easier to fix it. If you are unable to do that, then we recommend that you try out all the fixes one after another and something will work.

Unverified Self-signed SSL Certificate

Anyone can sign an SSL certificate by generating a signing key; however, the OS and the Web Browser may not be able to identify that. This could be the reason why you see the ‘SSL certificate problem: unable to get local issuer certificate’ or the ‘curl: (60) SSL certificate problem: unable to get local issuer certificate’ error.

Solution – Buy an SSL Certificate that is authenticated by a reputed certificate Authority and install it.

Alter the php.ini file to solve ‘unable to get local issuer certificate’

Log in to your web control panel such as cPanel and locate the file manager. You will then find the PHP software, and inside that, you can find the php.ini file that you need to edit. Follow the below-mentioned steps.

Change Php.ini

• Click on http://curl.haxx.se/ca/cacert.pem and download cacert.pem.
• After that, copy cacert.pem to openssl/zend, like ‘/usr/local/openssl-0.9.8/certs/cacert.pem’.
• Finally, navigate to the php.ini file, modify CURL. Add “cainfo = ‘/usr/local/openssl-0.9.8/certs/cacert.pem’” to modify it.
• Restart PHP
• Confirm if CURL can now read the HTTPS URL.

Without Altering php.ini file

Use the code given below:

$ch = curl_init();
$certificate_location = ‘/usr/local/openssl-0.9.8/certs/cacert.pem’;
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, $certificate_location);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, $certificate_location);

Git Users

Most Git users experience the ‘SSL certificate problem: unable to get local issuer certificate’ or the ‘git SSL certificate problem unable to get local issuer certificate’ error at some point in time. If you have encountered it, then there are two ways of solving this — the first one is a permanent fix and the second one is a temporary fix, which we shall discuss below.

Permanent Fix

If you are a Git user-facing the ‘git SSL certificate problem unable to get local issuer certificate’ error, then you need to tell Git where the CA bundle is located.

To help Git find the CA bundle, use the below-mentioned command:

git config –system http.sslCAPath /absolute/path/to/git/certificates

Temporary Fix

To temporarily fix the ‘SSL certificate problem: unable to get local issuer certificate’ error, you could disable the verification of your SSL certificate. However, we recommend that you use it sparingly as it could lower your website’s security.

Use the following command to disable the verification of your SSL certificate:

git config –global http.sslVerify false

If neither of the two options work, consider removing and reinstalling Git.

Conclusion:

We are confident that one of the above ‘SSL certificate problem: unable to get local issuer certificate’ error fixes would work for you. Finally, we strongly recommend that you entirely avoid removing your SSL certificate. Your website needs to be protected, and one of your most robust defenses is an active SSL certificate.

Related SSL Errors:

• ERR_CONNECTION_REFUSED
• Secure Connection Failed in Firefox
• NET::ERR_CERT_AUTHORITY_INVALID
• ERR_SSL_VERSION_INTERFERENCE
• ERR_SSL_PROTOCOL_ERROR

Tips for solving an uncommon SSL/TLS error – “SSL Certificate Problem: Unable to get Local Issuer Certificate”

While executing a cURL request to a secure HTTPS destination, have you ever received the message “SSL certificate problem: unable to get local issuer certificate?”

And do you keep getting the same “SSL certificate problem: “unable to get local issuer certificate” message no matter how much you change your cURL request or verify your URL?

In this article, we’ll give you the prime cause for this error and show you how to fix the “SSL certificate problem: unable to get local issuer certificate” error.

Cause of SSL Certificate Problem: Unable to get Local Issuer Certificate

The common cause behind “Cause of SSL Certificate Problem: Unable to get Local Issuer Certificate” is an error that causes misconfiguration while sending all the root and intermediate certificates to the webserver correctly at the time of SSL/TLS communication between the client and the server.

In some cases, when you’re using client SSL certificates, when you make a request to a secure HTTPS source, you have to share an SSL certificate to verify your identity. As such, if you come across the “SSL certificate problem: unable to get local issuer certificate” error, it’s an indication that the root certificates on the system are not working correctly.

Read on to find out how to troubleshoot “SSL certificate problem: unable to get local issuer certificate”.

Buy Cheap Wildcard SSL Certificates

Solutions to SSL Certificate Problem: Unable to get Local Issuer Certificate

You have three primary solutions for the “SSL certificate problem: unable to get local issuer certificate” error.

1. Change php.ini (Maintain SSL)

• Go to http://curl.haxx.se/ca/cacert.pem and download cacert.pem.
• Copy cacert.pem to your version of openssl/zend, such as ‘/usr/local/openssl-0.9.8/certs/cacert.pem’.
• In your php.ini file, modify the CURL configuration by adding “cainfo = ‘/usr/local/openssl-0.9.8/certs/cacert.pem’”
• Restart PHP and see if CURL is able to read HTTPS URL now.

2. Don’t Change php.ini (Maintain SSL)

Enter the following code:

$ch = curl_init();
$certificate_location = ‘/usr/local/openssl-0.9.8/certs/cacert.pem’;
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, $certificate_location);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, $certificate_location);

3. Disable SSL (Not Recommended)

Enter the following code:

$ch = curl_init();
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);

One of these solutions is bound to work for you and you will no longer encounter the message “SSL certificate problem: unable to get local issuer certificate”.

Read other important SSL certificate blog posts on SSL errors.

• SSL_Error_rx_record_too_long – The Trouble Shooting Guide
• ERR_CONNECTION_REFUSED in Chrome – Fixing Guide by SSLSecurity
• How to Fix ERR_SSL_VERSION_OR_CIPHER_MISMATCH Error
• Your Connection is not Private Error – A Fixing Guide for all devices

Registering here, maybe I can help someone. I had this same problem and this, besides disturbing my «curl», also broke a fultter application that consumed this site(nodejs over nginx server in VM).

In my case the problem was with my certificate, I wasn’t using the fullchain, the godaddy certificate was missing. Initially I had a .pfx file (Azure). I performed the following steps to get my necessary files

openssl pkcs12 -in <filename.pfx> -nocerts -nodes | sed -ne '/-BEGIN PRIVATE KEY-/,/-END PRIVATE KEY-/p' > <clientcert.key>
openssl pkcs12 -in <filename.pfx> -clcerts -nokeys | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > <clientcert.cer>
openssl pkcs12 -in <filename.pfx> -cacerts -nokeys -chain | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > <cacerts.cer>

After that I put my clientcert.cer content right in front of the cacerts.cer content so it looks something like this >>

——BEGIN CERTIFICATE——
…….
——END CERTIFICATE——
——BEGIN CERTIFICATE——
…………
——END CERTIFICATE——
——BEGIN CERTIFICATE——
…………..
——END CERTIFICATE——

then just put it to my nginx server to read this cert file concatenated in ssl_certificate and the key file generated earlier being read in ssl_certificate_key

Home » cURL error 60: SSL certificate problem: unable to get local issuer certificate

Last updated on June 17, 2022 by