PHP Tools for Visual Studio 2022 1.85.17447
I'm attempting to verify that my web host has a DigiCert global certificate installed, so I'm making a PHP 8.3 curl call using a downloaded root certificate from DigiCert, but for the life of me I can't get past the "SSL certificate problem: unable to get local issuer certificate" error. I'm pretty sure this is some kind of config problem as all the suggestions I've extensively researched have failed.
I've tried setting the [curl] curl.cainfo and [openssl] openssl.cafile in php.ini to no avail. It's always able to find the file, it just can't read it for some reason. Is this an issue with the curl lib on windows that PHP tools is using not being able to read a local pem file? I set security on the pem file to "everyone". I also tried copying it to the same folder that the php.ini lives. No love.
<?php
$url = "https://mywebsite.com"; // Replace with the target URL
$certPath = "C:\\Users\\xxx\\Desktop\\DigiCertGlobalRootG2.crt.pem"; // Path to the DigiCert certificate
// Initialize cURL
$ch = curl_init();
// Set cURL options
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true); // Enable SSL certificate verification
curl_setopt($ch, CURLOPT_CAINFO, $certPath); // Path to the DigiCert certificate
curl_setopt($ch, CURLOPT_VERBOSE, true); // Enable verbose output
// Open a file to log verbose output
$verboseLog = fopen('php://temp', 'w+');
curl_setopt($ch, CURLOPT_STDERR, $verboseLog);
$response = curl_exec($ch);
// Check for errors
if (curl_errno($ch)) {
echo "cURL error: " . curl_error($ch);
} else {
echo "Response: " . $response;
// Retrieve verbose output
}
rewind($verboseLog);
$verboseOutput = stream_get_contents($verboseLog);
echo "<pre>" . htmlspecialchars($verboseOutput) . "</pre>";
curl_close($ch);
fclose($verboseLog);
?>
Output:
cURL error: SSL certificate problem: unable to get local issuer certificate
* Host mywebsitewhatevers.com:443 was resolved.
* IPv6: (none)
* IPv4: 111.111.111.111
* Trying 111.111.111.111:443...
* Connected to mywebsitewhatevers.com: (111.111.111.111) port 443
* ALPN: curl offers h2,http/1.1
* CAfile: C:\Users\xxx\Desktop\DigiCertGlobalRootG2.crt.pem
* CApath: none
* SSL certificate problem: unable to get local issuer certificate
* Closing connection
The local pem file looks like this:
-----BEGIN CERTIFICATE-----
MIIDjjCCAnagAwIBAgIQAzrx5qcRqaC7KGSxHQn65TANBgkqhkiG9w0BAQsFADBh
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBH
MjAeFw0xMzA4MDExMjAwMDBaFw0zODAxMTUxMjAwMDBaMGExCzAJBgNVBAYTAlVT
MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j
b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IEcyMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuzfNNNx7a8myaJCtSnX/RrohCgiN9RlUyfuI
2/Ou8jqJkTx65qsGGmvPrC3oXgkkRLpimn7Wo6h+4FR1IAWsULecYxpsMNzaHxmx
1x7e/dfgy5SDN67sH0NO3Xss0r0upS/kqbitOtSZpLYl6ZtrAGCSYP9PIUkY92eQ
q2EGnI/yuum06ZIya7XzV+hdG82MHauVBJVJ8zUtluNJbd134/tJS7SsVQepj5Wz
tCO7TG1F8PapspUwtP1MVYwnSlcUfIKdzXOS0xZKBgyMUNGPHgm+F6HmIcr9g+UQ
vIOlCsRnKPZzFBQ9RnbDhxSJITRNrw9FDKZJobq7nMWxM4MphQIDAQABo0IwQDAP
BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHQ4EFgQUTiJUIBiV
5uNu5g/6+rkS7QYXjzkwDQYJKoZIhvcNAQELBQADggEBAGBnKJRvDkhj6zHd6mcY
1Yl9PMWLSn/pvtsrF9+wX3N3KjITOYFnQoQj8kVnNeyIv/iPsGEMNKSuIEyExtv4
NeF22d+mQrvHRAiGfzZ0JFrabA0UWTW98kndth/Jsw1HKj2ZL7tcu7XUIOGZX1NG
Fdtom/DzMNU+MeKNhJ7jitralj41E6Vf8PlwUHBHQRFXGU7Aj64GxJUTFy8bJZ91
8rGOmaFvE7FBcf6IKshPECBV1/MUReXgRPTqh5Uykw7+U0b6LJ3/iyK5S9kJRaTe
pLiaWN0bfVKfjllDiIGknibVb63dDcY3fe0Dkhvld1927jyNxF1WW6LZZm6zNTfl
MrY=
-----END CERTIFICATE-----
I exported the same DigiCert Global Root G2 certificate from my windows cert store and it exported the exact same thing so that looks correct. Or is that the wrong format for curl??
