24

I was using cURL on my localhost for the longest time and all the sudden I noticed it no longer works unless I explictly set the option, CURLOPT_SSL_VERIFYPEER=FALSE.

I have no idea how/when this changed but I'm using NGINX and PHP and I can verify that this is not a specific issue to a specific requested host. I'm getting blank responses from https://site1.com and https://different-site.com.

Anyone have any thoughts?

7
  • 1
    I love this hidden gem, it explains how you can use certificates to verify hosts.
    – Dave Chen
    Sep 24, 2013 at 2:35
  • unitstep.net/blog/2009/05/05/…
    – Young
    Sep 24, 2013 at 2:40
  • @DaveChen and -@Young thanks but do you have a sense as to why I didn't need to supply a certificate before, but do now? Sep 24, 2013 at 2:47
  • From another answer on the same question. cURL used to bundle CA certs, but now you must download them manually and pass them to cURL or give a default value within PHP.
    – Dave Chen
    Sep 24, 2013 at 2:54
  • those answers are 2 years old, this problem has arose for me in the last month. Sep 24, 2013 at 2:56

3 Answers 3

43

Thanks to Dave Chen's suggestions, I realized I must have misplaced my certificate. The problem is solved by this certificate which is provided by the cURL creator (extracted from Mozilla): https://curl.haxx.se/ca/cacert.pem

So after downloading this cacert.pem file into your project, in PHP you can now do this:

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, TRUE);
curl_setopt($ch, CURLOPT_CAINFO, "/path/to/cacert.pem");

Alternatively, this can be set globally by adding the following to your php.ini

curl.cainfo=/path/to/cacert.pem
3
  • 9
    I'm not a security expert but downloading .pem file form insecure source (http:) can be trusted?
    – Gihan
    Sep 8, 2015 at 11:26
  • where can i place this curl_setopt syntax if im using codeigniter Dec 17, 2017 at 3:00
  • About file name, some programs will expect this file to be named ca-bundle.crt (in the correct path) More details here
    – Alliswell
    Oct 1, 2021 at 9:05
5

If you are using WampServer, notice this:

You must put the absolute path in CURLOPT_CAINFO, for example:

curl_setopt ($ch, CURLOPT_CAINFO, 'C:\wamp\www\your-project\cacert.pem')

Don't use relative path: curl_setopt ($ch, CURLOPT_CAINFO, 'cacert.pem') because it doesn’t work.

1

The value for CURLOPT_SSL_VERIFYPEER by default is TRUE as of cURL 7.10.

Hence you may need to explicitly set it to FALSE to prevent CURL from verifying the certificate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.