blocks|key|2734552|text|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2734553|+[curl]+60:+SSL+certificate+problem:+unable+to+get+local+issuer+certificate|blockquote|offset|length|style|CODE|2734554|2734555|2734556|好吧，从外面看，看起来服务器证书是坏的。它不包括名称"googleapis.com“。|2734557|首先，使用openssl+s_client获取证书|2734558|openssl+s_client+-connect+googleapis.com:443|code-block|syntax|javascript|2734559|然后将证书保存到文件中。证书以-----BEGIN+CERTIFICATE-----开头，以-----END+CERTIFICATE-----结尾。|2734560|接下来，使用openssl+x509打印证书(如下所示)。它丢失了googleapis.com。|2734561|您可能需要接受名称不匹配，并固定服务器的公钥。谷歌每隔30天左右轮换他们的证书，以保持CRL对于移动客户端来说很小。这意味着你不能钉住证书。然而，谷歌重新认证了相同的公钥，因此像公钥钉住这样的密钥连续性方案起作用。|2734562|在使用openssl+s_client时，还有一个较小的第二个问题。s_client需要使用Google+Internet+Authority+G2的CAfile选项。缺少CA会导致下面的错误unable+to+get+local+issuer+certificate。你可以在pki.google.com下载谷歌的CA文件。|2734563|$+openssl+s_client+-connect+googleapis.com:443
CONNECTED(00000003)
depth=2+C+=+US,+O+=+GeoTrust+Inc.,+CN+=+GeoTrust+Global+CA
verify+error:num=20:unable+to+get+local+issuer+certificate
verify+return:0
---
Certificate+chain
+0+s:/C=US/ST=California/L=Mountain+View/O=Google+Inc/CN=google.com
+++i:/C=US/O=Google+Inc/CN=Google+Internet+Authority+G2
+1+s:/C=US/O=Google+Inc/CN=Google+Internet+Authority+G2
+++i:/C=US/O=GeoTrust+Inc./CN=GeoTrust+Global+CA
+2+s:/C=US/O=GeoTrust+Inc./CN=GeoTrust+Global+CA
+++i:/C=US/O=Equifax/OU=Equifax+Secure+Certificate+Authority|2734564|您还可以使用Equifax+Secure+Certificate+Authority作为信任的根，因为它似乎是Equifax交叉认证的谷歌CA。|2734565|但名称不匹配是一个破坏交易的因素。这是X509证书应该做的一件事:通过受信任的机构将一个实体(如服务器名称或用户)绑定到一个公钥。谁签署了损坏的证书并不重要(我本可以签署它)。|2734566|2734567|$+openssl+x509+-in+googleapis-com.txt+-inform+PEM+-text+-noout+
Certificate:
++++Data:
++++++++Version:+3+(0x2)
++++++++Serial+Number:+9106978240760957072+(0x7e627c7589c4c890)
++++Signature+Algorithm:+sha1WithRSAEncryption
++++++++Issuer:+C=US,+O=Google+Inc,+CN=Google+Internet+Authority+G2
++++++++Validity
++++++++++++Not+Before:+Jul++2+13:04:27+2014+GMT
++++++++++++Not+After+:+Sep+30+00:00:00+2014+GMT
++++++++Subject:+C=US,+ST=California,+L=Mountain+View,+O=Google+Inc,+CN=google.com
++++++++Subject+Public+Key+Info:
++++++++++++Public+Key+Algorithm:+rsaEncryption
++++++++++++++++Public-Key:+(2048+bit)
++++++++++++++++Modulus:
++++++++++++++++++++00:ab:02:29:67:f1:08:cc:f0:5c:63:ff:75:b3:bd:
++++++++++++++++++++41:62:c6:83:0c:3b:e6:1b:9a:41:0d:dc:5a:b3:34:
++++++++++++++++++++db:a3:37:6f:4f:bf:f5:8a:01:39:6a:91:b7:d1:a6:
++++++++++++++++++++83:6d:c6:28:60:79:c9:07:f2:ad:23:00:f2:31:74:
++++++++++++++++++++b0:a3:d0:d6:ac:5a:f4:31:c8:98:9c:49:c6:20:0b:
++++++++++++++++++++ce:81:2b:51:b6:54:0f:65:54:f2:b3:08:c9:c0:c8:
++++++++++++++++++++ca:a6:ec:bb:fc:8e:a5:64:70:6b:dc:08:45:9c:14:
++++++++++++++++++++cd:cd:aa:49:fd:e9:a5:f1:7d:c6:f8:5d:52:e8:d8:
++++++++++++++++++++3d:21:81:46:49:ba:f7:bd:7d:07:42:31:cf:79:61:
++++++++++++++++++++b1:47:2c:ba:ce:5a:cd:52:4a:5f:d2:b6:88:d0:a2:
++++++++++++++++++++94:53:e2:65:d6:66:80:43:17:e1:2e:43:ab:ca:2f:
++++++++++++++++++++79:e6:11:8b:4a:35:fa:e1:43:e3:49:66:5a:1f:e0:
++++++++++++++++++++a3:1c:5e:1c:6e:aa:de:0d:ba:cb:20:e3:3d:9e:66:
++++++++++++++++++++47:32:25:3c:01:22:b3:69:a6:96:0e:2e:13:c7:fd:
++++++++++++++++++++70:c6:61:7e:a9:f0:ad:a4:a6:41:13:36:8c:46:74:
++++++++++++++++++++c8:a5:ac:b0:b5:17:00:b8:0e:62:79:1a:fc:7e:7c:
++++++++++++++++++++2b:f7:2e:c0:ab:07:fc:8e:46:3c:8f:f2:e5:6e:8f:
++++++++++++++++++++83:17
++++++++++++++++Exponent:+65537+(0x10001)
++++++++X509v3+extensions:
++++++++++++X509v3+Extended+Key+Usage:+
++++++++++++++++TLS+Web+Server+Authentication,+TLS+Web+Client+Authentication
++++++++++++X509v3+Subject+Alternative+Name:+

++++++++++++++++DNS:google.com,+DNS:*.2mdn.net,+DNS:*.android.com,+DNS:*.appengine.google.com,+
DNS:*.au.doubleclick.net,+DNS:*.cc-dt.com,+DNS:*.cloud.google.com,+DNS:*.de.doubleclick.net,+
DNS:*.doubleclick.com,+DNS:*.doubleclick.net,+DNS:*.fls.doubleclick.net,+DNS:*.fr.doubleclick.net,+
DNS:*.google-analytics.com,+DNS:*.google.ac,+DNS:*.google.ad,+DNS:*.google.ae,+DNS:*.google.af,+
DNS:*.google.ag,+DNS:*.google.al,+DNS:*.google.am,+DNS:*.google.as,+DNS:*.google.at,+
DNS:*.google.az,+DNS:*.google.ba,+DNS:*.google.be,+DNS:*.google.bf,+DNS:*.google.bg,+
DNS:*.google.bi,+DNS:*.google.bj,+DNS:*.google.bs,+DNS:*.google.bt,+DNS:*.google.by,+
DNS:*.google.ca,+DNS:*.google.cat,+DNS:*.google.cc,+DNS:*.google.cd,+DNS:*.google.cf,+
DNS:*.google.cg,+DNS:*.google.ch,+DNS:*.google.ci,+DNS:*.google.cl,+DNS:*.google.cm,+
DNS:*.google.cn,+DNS:*.google.co.ao,+DNS:*.google.co.bw,+DNS:*.google.co.ck,+DNS:*.google.co.cr,+
DNS:*.google.co.hu,+DNS:*.google.co.id,+DNS:*.google.co.il,+DNS:*.google.co.im,+DNS:*.google.co.in,+
DNS:*.google.co.je,+DNS:*.google.co.jp,+DNS:*.google.co.ke,+DNS:*.google.co.kr,+DNS:*.google.co.ls,+
DNS:*.google.co.ma,+DNS:*.google.co.mz,+DNS:*.google.co.nz,+DNS:*.google.co.th,+DNS:*.google.co.tz,+
DNS:*.google.co.ug,+DNS:*.google.co.uk,+DNS:*.google.co.uz,+DNS:*.google.co.ve,+DNS:*.google.co.vi,+
DNS:*.google.co.za,+DNS:*.google.co.zm,+DNS:*.google.co.zw,+DNS:*.google.com,+DNS:*.google.com.af,+
DNS:*.google.com.ag,+DNS:*.google.com.ai,+DNS:*.google.com.ar,+DNS:*.google.com.au,+
DNS:*.google.com.bd,+DNS:*.google.com.bh,+DNS:*.google.com.bn,+DNS:*.google.com.bo,+
DNS:*.google.com.br,+DNS:*.google.com.by,+DNS:*.google.com.bz,+DNS:*.google.com.cn,+
DNS:*.google.com.co,+DNS:*.google.com.cu,+DNS:*.google.com.cy,+DNS:*.google.com.do,+
DNS:*.google.com.ec,+DNS:*.google.com.eg,+DNS:*.google.com.et,+DNS:*.google.com.fj,+
DNS:*.google.com.ge,+DNS:*.google.com.gh,+DNS:*.google.com.gi,+DNS:*.google.com.gr,+
DNS:*.google.com.gt,+DNS:*.google.com.hk,+DNS:*.google.com.iq,+DNS:*.google.com.jm,+
DNS:*.google.com.jo,+DNS:*.google.com.kh,+DNS:*.google.com.kw,+DNS:*.google.com.lb,+
DNS:*.google.com.ly,+DNS:*.google.com.mm,+DNS:*.google.com.mt,+DNS:*.google.com.mx,+
DNS:*.google.com.my,+DNS:*.google.com.na,+DNS:*.google.com.nf,+DNS:*.google.com.ng,+
DNS:*.google.com.ni,+DNS:*.google.com.np,+DNS:*.google.com.nr,+DNS:*.google.com.om,+
DNS:*.google.com.pa,+DNS:*.google.com.pe,+DNS:*.google.com.pg,+DNS:*.google.com.ph,+
DNS:*.google.com.pk,+DNS:*.google.com.pl,+DNS:*.google.com.pr,+DNS:*.google.com.py,+
DNS:*.google.com.qa,+DNS:*.google.com.ru,+DNS:*.google.com.sa,+DNS:*.google.com.sb,+
DNS:*.google.com.sg,+DNS:*.google.com.sl,+DNS:*.google.com.sv,+DNS:*.google.com.tj,+
DNS:*.google.com.tn,+DNS:*.google.com.tr,+DNS:*.google.com.tw,+DNS:*.google.com.ua,+
DNS:*.google.com.uy,+DNS:*.google.com.vc,+DNS:*.google.com.ve,+DNS:*.google.com.vn,+DNS:*.google.cv,+
DNS:*.google.cz,+DNS:*.google.de,+DNS:*.google.dj,+DNS:*.google.dk,+DNS:*.google.dm,+
DNS:*.google.dz,+DNS:*.google.ee,+DNS:*.google.es,+DNS:*.google.fi,+DNS:*.google.fm,+
DNS:*.google.fr,+DNS:*.google.ga,+DNS:*.google.ge,+DNS:*.google.gg,+DNS:*.google.gl,+
DNS:*.google.gm,+DNS:*.google.gp,+DNS:*.google.gr,+DNS:*.google.gy,+DNS:*.google.hk,+
DNS:*.google.hn,+DNS:*.google.hr,+DNS:*.google.ht,+DNS:*.google.hu,+DNS:*.google.ie,+
DNS:*.google.im,+DNS:*.google.info,+DNS:*.google.iq,+DNS:*.google.ir,+DNS:*.google.is,+
DNS:*.google.it,+DNS:*.google.it.ao,+DNS:*.google.je,+DNS:*.google.jo,+DNS:*.google.jobs,+
DNS:*.google.jp,+DNS:*.google.kg,+DNS:*.google.ki,+DNS:*.google.kz,+DNS:*.google.la,+
DNS:*.google.li,+DNS:*.google.lk,+DNS:*.google.lt,+DNS:*.google.lu,+DNS:*.google.lv,+
DNS:*.google.md,+DNS:*.google.me,+DNS:*.google.mg,+DNS:*.google.mk,+DNS:*.google.ml,+
DNS:*.google.mn,+DNS:*.google.ms,+DNS:*.google.mu,+DNS:*.google.mv,+DNS:*.google.mw,+
DNS:*.google.ne,+DNS:*.google.ne.jp,+DNS:*.google.net,+DNS:*.google.ng,+DNS:*.google.nl,+
DNS:*.google.no,+DNS:*.google.nr,+DNS:*.google.nu,+DNS:*.google.off.ai,+DNS:*.google.pk,+
DNS:*.google.pl,+DNS:*.google.pn,+DNS:*.google.ps,+DNS:*.google.pt,+DNS:*.google.ro,+
DNS:*.google.rs,+DNS:*.google.ru,+DNS:*.google.rw,+DNS:*.google.sc,+DNS:*.google.se,+
DNS:*.google.sh,+DNS:*.google.si,+DNS:*.google.sk,+DNS:*.google.sm,+DNS:*.google.sn,+
DNS:*.google.so,+DNS:*.google.sr,+DNS:*.google.st,+DNS:*.google.td,+DNS:*.google.tg,+
DNS:*.google.tk,+DNS:*.google.tl,+DNS:*.google.tm,+DNS:*.google.tn,+DNS:*.google.to,+
DNS:*.google.tt,+DNS:*.google.us,+DNS:*.google.uz,+DNS:*.google.vg,+DNS:*.google.vu,+
DNS:*.google.ws,+DNS:*.googleapis.cn,+DNS:*.googlecommerce.com,+DNS:*.googlevideo.com,+
DNS:*.gstatic.com,+DNS:*.gvt1.com,+DNS:*.jp.doubleclick.net,+DNS:*.metric.gstatic.com,+
DNS:*.uk.doubleclick.net,+DNS:*.urchin.com,+DNS:*.url.google.com,+DNS:*.youtube-nocookie.com,+
DNS:*.youtube.com,+DNS:*.youtubeeducation.com,+DNS:*.ytimg.com,+DNS:ad.mo.doubleclick.net,+
DNS:android.com,+DNS:doubleclick.net,+DNS:g.co,+DNS:goo.gl,+DNS:google-analytics.com,+DNS:google.ac,+
DNS:google.ad,+DNS:google.ae,+DNS:google.af,+DNS:google.ag,+DNS:google.al,+DNS:google.am,+
DNS:google.as,+DNS:google.at,+DNS:google.az,+DNS:google.ba,+DNS:google.be,+DNS:google.bf,+
DNS:google.bg,+DNS:google.bi,+DNS:google.bj,+DNS:google.bs,+DNS:google.bt,+DNS:google.by,+
DNS:google.ca,+DNS:google.cat,+DNS:google.cc,+DNS:google.cd,+DNS:google.cf,+DNS:google.cg,+
DNS:google.ch,+DNS:google.ci,+DNS:google.cl,+DNS:google.cm,+DNS:google.cn,+DNS:google.co.ao,+
DNS:google.co.bw,+DNS:google.co.ck,+DNS:google.co.cr,+DNS:google.co.hu,+DNS:google.co.id,+
DNS:google.co.il,+DNS:google.co.im,+DNS:google.co.in,+DNS:google.co.je,+DNS:google.co.jp,+
DNS:google.co.ke,+DNS:google.co.kr,+DNS:google.co.ls,+DNS:google.co.ma,+DNS:google.co.mz,+
DNS:google.co.nz,+DNS:google.co.th,+DNS:google.co.tz,+DNS:google.co.ug,+DNS:google.co.uk,+
DNS:google.co.uz,+DNS:google.co.ve,+DNS:google.co.vi,+DNS:google.co.za,+DNS:google.co.zm,+
DNS:google.co.zw,+DNS:google.com.af,+DNS:google.com.ag,+DNS:google.com.ai,+DNS:google.com.ar,+
DNS:google.com.au,+DNS:google.com.bd,+DNS:google.com.bh,+DNS:google.com.bn,+DNS:google.com.bo,+
DNS:google.com.br,+DNS:google.com.by,+DNS:google.com.bz,+DNS:google.com.cn,+DNS:google.com.co,+
DNS:google.com.cu,+DNS:google.com.cy,+DNS:google.com.do,+DNS:google.com.ec,+DNS:google.com.eg,+
DNS:google.com.et,+DNS:google.com.fj,+DNS:google.com.ge,+DNS:google.com.gh,+DNS:google.com.gi,+
DNS:google.com.gr,+DNS:google.com.gt,+DNS:google.com.hk,+DNS:google.com.iq,+DNS:google.com.jm,+
DNS:google.com.jo,+DNS:google.com.kh,+DNS:google.com.kw,+DNS:google.com.lb,+DNS:google.com.ly,+
DNS:google.com.mm,+DNS:google.com.mt,+DNS:google.com.mx,+DNS:google.com.my,+DNS:google.com.na,+
DNS:google.com.nf,+DNS:google.com.ng,+DNS:google.com.ni,+DNS:google.com.np,+DNS:google.com.nr,+
DNS:google.com.om,+DNS:google.com.pa,+DNS:google.com.pe,+DNS:google.com.pg,+DNS:google.com.ph,+
DNS:google.com.pk,+DNS:google.com.pl,+DNS:google.com.pr,+DNS:google.com.py,+DNS:google.com.qa,+
DNS:google.com.ru,+DNS:google.com.sa,+DNS:google.com.sb,+DNS:google.com.sg,+DNS:google.com.sl,+
DNS:google.com.sv,+DNS:google.com.tj,+DNS:google.com.tn,+DNS:google.com.tr,+DNS:google.com.tw,+
DNS:google.com.ua,+DNS:google.com.uy,+DNS:google.com.vc,+DNS:google.com.ve,+DNS:google.com.vn,+
DNS:google.cv,+DNS:google.cz,+DNS:google.de,+DNS:google.dj,+DNS:google.dk,+DNS:google.dm,+
DNS:google.dz,+DNS:google.ee,+DNS:google.es,+DNS:google.fi,+DNS:google.fm,+DNS:google.fr,+
DNS:google.ga,+DNS:google.ge,+DNS:google.gg,+DNS:google.gl,+DNS:google.gm,+DNS:google.gp,+
DNS:google.gr,+DNS:google.gy,+DNS:google.hk,+DNS:google.hn,+DNS:google.hr,+DNS:google.ht,+
DNS:google.hu,+DNS:google.ie,+DNS:google.im,+DNS:google.info,+DNS:google.iq,+DNS:google.ir,+
DNS:google.is,+DNS:google.it,+DNS:google.it.ao,+DNS:google.je,+DNS:google.jo,+DNS:google.jobs,+
DNS:google.jp,+DNS:google.kg,+DNS:google.ki,+DNS:google.kz,+DNS:google.la,+DNS:google.li,+
DNS:google.lk,+DNS:google.lt,+DNS:google.lu,+DNS:google.lv,+DNS:google.md,+DNS:google.me,+
DNS:google.mg,+DNS:google.mk,+DNS:google.ml,+DNS:google.mn,+DNS:google.ms,+DNS:google.mu,+
DNS:google.mv,+DNS:google.mw,+DNS:google.ne,+DNS:google.ne.jp,+DNS:google.net,+DNS:google.ng,+
DNS:google.nl,+DNS:google.no,+DNS:google.nr,+DNS:google.nu,+DNS:google.off.ai,+DNS:google.pk,+
DNS:google.pl,+DNS:google.pn,+DNS:google.ps,+DNS:google.pt,+DNS:google.ro,+DNS:google.rs,+
DNS:google.ru,+DNS:google.rw,+DNS:google.sc,+DNS:google.se,+DNS:google.sh,+DNS:google.si,+
DNS:google.sk,+DNS:google.sm,+DNS:google.sn,+DNS:google.so,+DNS:google.sr,+DNS:google.st,+
DNS:google.td,+DNS:google.tg,+DNS:google.tk,+DNS:google.tl,+DNS:google.tm,+DNS:google.tn,+
DNS:google.to,+DNS:google.tt,+DNS:google.us,+DNS:google.uz,+DNS:google.vg,+DNS:google.vu,+
DNS:google.ws,+DNS:googlecommerce.com,+DNS:gstatic.com,+DNS:urchin.com,+DNS:youtu.be,+
DNS:youtube.com,+DNS:youtubeeducation.com
++++++++++++Authority+Information+Access:+
++++++++++++++++CA+Issuers+-+URI:http://pki.google.com/GIAG2.crt
++++++++++++++++OCSP+-+URI:http://clients1.google.com/ocsp

++++++++++++X509v3+Subject+Key+Identifier:+
++++++++++++++++71:D7:BB:09:DE:42:EB:E5:E0:75:3D:49:64:97:E5:9A:8D:6E:C3:8E
++++++++++++X509v3+Basic+Constraints:+critical
++++++++++++++++CA:FALSE
++++++++++++X509v3+Authority+Key+Identifier:+
++++++++++++++++keyid:4A:DD:06:16:1B:BC:F6:68:B5:76:F5:81:B6:BB:62:1A:BA:5A:81:2F

++++++++++++X509v3+Certificate+Policies:+
++++++++++++++++Policy:+1.3.6.1.4.1.11129.2.5.1

++++++++++++X509v3+CRL+Distribution+Points:+

++++++++++++++++Full+Name:
++++++++++++++++++URI:http://pki.google.com/GIAG2.crl

++++Signature+Algorithm:+sha1WithRSAEncryption
+++++++++8f:f3:ec:dd:ca:45:d2:20:12:40:cd:ce:72:10:42:b5:ac:4b:
+++++++++8c:45:15:15:d7:9f:fb:01:e7:84:63:c6:41:b4:93:8b:79:ab:
+++++++++51:56:b9:3f:07:74:5b:c7:38:ad:f0:ee:97:53:3b:f8:2d:bc:
+++++++++94:23:ca:2e:1f:0c:5b:21:82:ae:b8:0f:55:43:1a:58:8f:4d:
+++++++++25:0a:80:32:a6:c9:ff:3f:43:f5:1f:39:63:9f:a6:82:20:b4:
+++++++++74:d4:e1:ef:e0:f9:92:c5:63:b6:e2:61:e4:e7:4e:c7:a3:dd:
+++++++++44:1b:32:e0:06:7f:84:b6:45:20:57:6a:71:07:c2:54:b0:69:
+++++++++9c:a2:f6:3f:5f:52:ca:9e:ba:77:b3:0b:4f:2a:b7:14:ca:c9:
+++++++++7a:6c:f3:ce:2b:aa:c1:0d:ea:33:8f:e6:39:24:83:84:dc:3c:
+++++++++ac:f0:83:2e:98:9f:2f:54:de:c4:c5:b0:05:a3:e3:ca:a5:13:
+++++++++9c:28:ba:6b:e9:ee:e0:10:41:4a:d7:78:cd:60:0f:79:0f:0a:
+++++++++e3:76:46:ce:7a:b4:84:1b:07:91:21:83:23:17:7a:77:e8:32:
+++++++++3b:14:7c:3a:a8:fb:d6:c2:bf:18:4a:ad:d7:c1:d6:30:cd:67:
+++++++++b4:8f:7d:27:43:97:b8:12:9d:0b:7e:ae:de:27:83:fa:89:29:
+++++++++d9:be:e4:43|2734568|entityMap|0|LINK|mutability|MUTABLE|url|https://pki.google.com/^0|0|1|22|0|0|0|0|5|G|0|0|F|R|1A|P|0|6|C|X|E|0|0|3|G|Y|8|1A|S|23|6|2O|12|3V|E|0|0|0|6|10|0|0|0|0^^$0|@$1|2|3|-4|4|5|6|1H|7|@]|8|@]|9|$]]|$1|A|3|B|4|C|6|1I|7|@$D|1J|E|1K|F|G]]|8|@]|9|$]]|$1|H|3|-4|4|5|6|1L|7|@]|8|@]|9|$]]|$1|I|3|-4|4|5|6|1M|7|@]|8|@]|9|$]]|$1|J|3|K|4|5|6|1N|7|@]|8|@]|9|$]]|$1|L|3|M|4|5|6|1O|7|@$D|1P|E|1Q|F|G]]|8|@]|9|$]]|$1|N|3|O|4|P|6|1R|7|@]|8|@]|9|$Q|R]]|$1|S|3|T|4|5|6|1S|7|@$D|1T|E|1U|F|G]|$D|1V|E|1W|F|G]]|8|@]|9|$]]|$1|U|3|V|4|5|6|1X|7|@$D|1Y|E|1Z|F|G]|$D|20|E|21|F|G]]|8|@]|9|$]]|$1|W|3|X|4|5|6|22|7|@]|8|@]|9|$]]|$1|Y|3|Z|4|5|6|23|7|@$D|24|E|25|F|G]|$D|26|E|27|F|G]|$D|28|E|29|F|G]|$D|2A|E|2B|F|G]|$D|2C|E|2D|F|G]]|8|@$D|2E|E|2F|1|2G]]|9|$]]|$1|10|3|11|4|P|6|2H|7|@]|8|@]|9|$Q|R]]|$1|12|3|13|4|5|6|2I|7|@$D|2J|E|2K|F|G]]|8|@]|9|$]]|$1|14|3|15|4|5|6|2L|7|@]|8|@]|9|$]]|$1|16|3|-4|4|5|6|2M|7|@]|8|@]|9|$]]|$1|17|3|18|4|P|6|2N|7|@]|8|@]|9|$Q|R]]|$1|19|3|-4|4|5|6|2O|7|@]|8|@]|9|$]]]|1A|$1B|$4|1C|1D|1E|9|$1F|1G]]]]

<blockquote>
 <code>[curl] 60: SSL certificate problem: unable to get local issuer certificate</code>
</blockquote>

Well, from the outside looking in, it looks like the server certificate is bad. It does not include the name "googleapis.com".

First, fetch the certificate with <code>openssl s_client</code>:

<pre><code>openssl s_client -connect googleapis.com:443
</code></pre>

Then save the certificate to a file. The certificate starts with <code>-----BEGIN CERTIFICATE-----</code> and ends with <code>-----END CERTIFICATE-----</code>.

Next, print the certificate with <code>openssl x509</code> (shown below). Its missing <code>googleapis.com</code>.

You probably need to accept the name mismatch, and pin the server's public key. Google rotates their certificates every 30 days or so to keep CRLs small for mobile clients. That means you can't pin the certificate. However, Google re-certifies the same public key, so key continuity schemes like public key pinning work.

There's a smaller, second issue when using <code>openssl s_client</code>. <code>s_client</code> needs the option <code>CAfile</code> using <code>Google Internet Authority G2</code>. The missing CA is causing the error <code>unable to get local issuer certificate</code> below. You can download Google's CA file at <a href="https://pki.google.com/" rel="noreferrer">pki.google.com</a>.

<pre><code>$ openssl s_client -connect googleapis.com:443
CONNECTED(00000003)
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=google.com
 i:/C=US/O=Google Inc/CN=Google Internet Authority G2
 1 s:/C=US/O=Google Inc/CN=Google Internet Authority G2
 i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
 i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
</code></pre>

You could also use <code>Equifax Secure Certificate Authority</code> as the root of trust because it appears Equifax cross-certified Google's CA.

But the name mismatch is a deal breaker. That's the one thing an X509 certificate is supposed to do: bind a entity, like a server name or user, to a public key through a trusted authority. It does not matter who signed the broken certificate (I could have signed it).

<hr>

<pre><code>$ openssl x509 -in googleapis-com.txt -inform PEM -text -noout 
Certificate:
 Data:
 Version: 3 (0x2)
 Serial Number: 9106978240760957072 (0x7e627c7589c4c890)
 Signature Algorithm: sha1WithRSAEncryption
 Issuer: C=US, O=Google Inc, CN=Google Internet Authority G2
 Validity
 Not Before: Jul 2 13:04:27 2014 GMT
 Not After : Sep 30 00:00:00 2014 GMT
 Subject: C=US, ST=California, L=Mountain View, O=Google Inc, CN=google.com
 Subject Public Key Info:
 Public Key Algorithm: rsaEncryption
 Public-Key: (2048 bit)
 Modulus:
 00:ab:02:29:67:f1:08:cc:f0:5c:63:ff:75:b3:bd:
 41:62:c6:83:0c:3b:e6:1b:9a:41:0d:dc:5a:b3:34:
 db:a3:37:6f:4f:bf:f5:8a:01:39:6a:91:b7:d1:a6:
 83:6d:c6:28:60:79:c9:07:f2:ad:23:00:f2:31:74:
 b0:a3:d0:d6:ac:5a:f4:31:c8:98:9c:49:c6:20:0b:
 ce:81:2b:51:b6:54:0f:65:54:f2:b3:08:c9:c0:c8:
 ca:a6:ec:bb:fc:8e:a5:64:70:6b:dc:08:45:9c:14:
 cd:cd:aa:49:fd:e9:a5:f1:7d:c6:f8:5d:52:e8:d8:
 3d:21:81:46:49:ba:f7:bd:7d:07:42:31:cf:79:61:
 b1:47:2c:ba:ce:5a:cd:52:4a:5f:d2:b6:88:d0:a2:
 94:53:e2:65:d6:66:80:43:17:e1:2e:43:ab:ca:2f:
 79:e6:11:8b:4a:35:fa:e1:43:e3:49:66:5a:1f:e0:
 a3:1c:5e:1c:6e:aa:de:0d:ba:cb:20:e3:3d:9e:66:
 47:32:25:3c:01:22:b3:69:a6:96:0e:2e:13:c7:fd:
 70:c6:61:7e:a9:f0:ad:a4:a6:41:13:36:8c:46:74:
 c8:a5:ac:b0:b5:17:00:b8:0e:62:79:1a:fc:7e:7c:
 2b:f7:2e:c0:ab:07:fc:8e:46:3c:8f:f2:e5:6e:8f:
 83:17
 Exponent: 65537 (0x10001)
 X509v3 extensions:
 X509v3 Extended Key Usage: 
 TLS Web Server Authentication, TLS Web Client Authentication
 X509v3 Subject Alternative Name: 

 DNS:google.com, DNS:*.2mdn.net, DNS:*.android.com, DNS:*.appengine.google.com, 
DNS:*.au.doubleclick.net, DNS:*.cc-dt.com, DNS:*.cloud.google.com, DNS:*.de.doubleclick.net, 
DNS:*.doubleclick.com, DNS:*.doubleclick.net, DNS:*.fls.doubleclick.net, DNS:*.fr.doubleclick.net, 
DNS:*.google-analytics.com, DNS:*.google.ac, DNS:*.google.ad, DNS:*.google.ae, DNS:*.google.af, 
DNS:*.google.ag, DNS:*.google.al, DNS:*.google.am, DNS:*.google.as, DNS:*.google.at, 
DNS:*.google.az, DNS:*.google.ba, DNS:*.google.be, DNS:*.google.bf, DNS:*.google.bg, 
DNS:*.google.bi, DNS:*.google.bj, DNS:*.google.bs, DNS:*.google.bt, DNS:*.google.by, 
DNS:*.google.ca, DNS:*.google.cat, DNS:*.google.cc, DNS:*.google.cd, DNS:*.google.cf, 
DNS:*.google.cg, DNS:*.google.ch, DNS:*.google.ci, DNS:*.google.cl, DNS:*.google.cm, 
DNS:*.google.cn, DNS:*.google.co.ao, DNS:*.google.co.bw, DNS:*.google.co.ck, DNS:*.google.co.cr, 
DNS:*.google.co.hu, DNS:*.google.co.id, DNS:*.google.co.il, DNS:*.google.co.im, DNS:*.google.co.in, 
DNS:*.google.co.je, DNS:*.google.co.jp, DNS:*.google.co.ke, DNS:*.google.co.kr, DNS:*.google.co.ls, 
DNS:*.google.co.ma, DNS:*.google.co.mz, DNS:*.google.co.nz, DNS:*.google.co.th, DNS:*.google.co.tz, 
DNS:*.google.co.ug, DNS:*.google.co.uk, DNS:*.google.co.uz, DNS:*.google.co.ve, DNS:*.google.co.vi, 
DNS:*.google.co.za, DNS:*.google.co.zm, DNS:*.google.co.zw, DNS:*.google.com, DNS:*.google.com.af, 
DNS:*.google.com.ag, DNS:*.google.com.ai, DNS:*.google.com.ar, DNS:*.google.com.au, 
DNS:*.google.com.bd, DNS:*.google.com.bh, DNS:*.google.com.bn, DNS:*.google.com.bo, 
DNS:*.google.com.br, DNS:*.google.com.by, DNS:*.google.com.bz, DNS:*.google.com.cn, 
DNS:*.google.com.co, DNS:*.google.com.cu, DNS:*.google.com.cy, DNS:*.google.com.do, 
DNS:*.google.com.ec, DNS:*.google.com.eg, DNS:*.google.com.et, DNS:*.google.com.fj, 
DNS:*.google.com.ge, DNS:*.google.com.gh, DNS:*.google.com.gi, DNS:*.google.com.gr, 
DNS:*.google.com.gt, DNS:*.google.com.hk, DNS:*.google.com.iq, DNS:*.google.com.jm, 
DNS:*.google.com.jo, DNS:*.google.com.kh, DNS:*.google.com.kw, DNS:*.google.com.lb, 
DNS:*.google.com.ly, DNS:*.google.com.mm, DNS:*.google.com.mt, DNS:*.google.com.mx, 
DNS:*.google.com.my, DNS:*.google.com.na, DNS:*.google.com.nf, DNS:*.google.com.ng, 
DNS:*.google.com.ni, DNS:*.google.com.np, DNS:*.google.com.nr, DNS:*.google.com.om, 
DNS:*.google.com.pa, DNS:*.google.com.pe, DNS:*.google.com.pg, DNS:*.google.com.ph, 
DNS:*.google.com.pk, DNS:*.google.com.pl, DNS:*.google.com.pr, DNS:*.google.com.py, 
DNS:*.google.com.qa, DNS:*.google.com.ru, DNS:*.google.com.sa, DNS:*.google.com.sb, 
DNS:*.google.com.sg, DNS:*.google.com.sl, DNS:*.google.com.sv, DNS:*.google.com.tj, 
DNS:*.google.com.tn, DNS:*.google.com.tr, DNS:*.google.com.tw, DNS:*.google.com.ua, 
DNS:*.google.com.uy, DNS:*.google.com.vc, DNS:*.google.com.ve, DNS:*.google.com.vn, DNS:*.google.cv, 
DNS:*.google.cz, DNS:*.google.de, DNS:*.google.dj, DNS:*.google.dk, DNS:*.google.dm, 
DNS:*.google.dz, DNS:*.google.ee, DNS:*.google.es, DNS:*.google.fi, DNS:*.google.fm, 
DNS:*.google.fr, DNS:*.google.ga, DNS:*.google.ge, DNS:*.google.gg, DNS:*.google.gl, 
DNS:*.google.gm, DNS:*.google.gp, DNS:*.google.gr, DNS:*.google.gy, DNS:*.google.hk, 
DNS:*.google.hn, DNS:*.google.hr, DNS:*.google.ht, DNS:*.google.hu, DNS:*.google.ie, 
DNS:*.google.im, DNS:*.google.info, DNS:*.google.iq, DNS:*.google.ir, DNS:*.google.is, 
DNS:*.google.it, DNS:*.google.it.ao, DNS:*.google.je, DNS:*.google.jo, DNS:*.google.jobs, 
DNS:*.google.jp, DNS:*.google.kg, DNS:*.google.ki, DNS:*.google.kz, DNS:*.google.la, 
DNS:*.google.li, DNS:*.google.lk, DNS:*.google.lt, DNS:*.google.lu, DNS:*.google.lv, 
DNS:*.google.md, DNS:*.google.me, DNS:*.google.mg, DNS:*.google.mk, DNS:*.google.ml, 
DNS:*.google.mn, DNS:*.google.ms, DNS:*.google.mu, DNS:*.google.mv, DNS:*.google.mw, 
DNS:*.google.ne, DNS:*.google.ne.jp, DNS:*.google.net, DNS:*.google.ng, DNS:*.google.nl, 
DNS:*.google.no, DNS:*.google.nr, DNS:*.google.nu, DNS:*.google.off.ai, DNS:*.google.pk, 
DNS:*.google.pl, DNS:*.google.pn, DNS:*.google.ps, DNS:*.google.pt, DNS:*.google.ro, 
DNS:*.google.rs, DNS:*.google.ru, DNS:*.google.rw, DNS:*.google.sc, DNS:*.google.se, 
DNS:*.google.sh, DNS:*.google.si, DNS:*.google.sk, DNS:*.google.sm, DNS:*.google.sn, 
DNS:*.google.so, DNS:*.google.sr, DNS:*.google.st, DNS:*.google.td, DNS:*.google.tg, 
DNS:*.google.tk, DNS:*.google.tl, DNS:*.google.tm, DNS:*.google.tn, DNS:*.google.to, 
DNS:*.google.tt, DNS:*.google.us, DNS:*.google.uz, DNS:*.google.vg, DNS:*.google.vu, 
DNS:*.google.ws, DNS:*.googleapis.cn, DNS:*.googlecommerce.com, DNS:*.googlevideo.com, 
DNS:*.gstatic.com, DNS:*.gvt1.com, DNS:*.jp.doubleclick.net, DNS:*.metric.gstatic.com, 
DNS:*.uk.doubleclick.net, DNS:*.urchin.com, DNS:*.url.google.com, DNS:*.youtube-nocookie.com, 
DNS:*.youtube.com, DNS:*.youtubeeducation.com, DNS:*.ytimg.com, DNS:ad.mo.doubleclick.net, 
DNS:android.com, DNS:doubleclick.net, DNS:g.co, DNS:goo.gl, DNS:google-analytics.com, DNS:google.ac, 
DNS:google.ad, DNS:google.ae, DNS:google.af, DNS:google.ag, DNS:google.al, DNS:google.am, 
DNS:google.as, DNS:google.at, DNS:google.az, DNS:google.ba, DNS:google.be, DNS:google.bf, 
DNS:google.bg, DNS:google.bi, DNS:google.bj, DNS:google.bs, DNS:google.bt, DNS:google.by, 
DNS:google.ca, DNS:google.cat, DNS:google.cc, DNS:google.cd, DNS:google.cf, DNS:google.cg, 
DNS:google.ch, DNS:google.ci, DNS:google.cl, DNS:google.cm, DNS:google.cn, DNS:google.co.ao, 
DNS:google.co.bw, DNS:google.co.ck, DNS:google.co.cr, DNS:google.co.hu, DNS:google.co.id, 
DNS:google.co.il, DNS:google.co.im, DNS:google.co.in, DNS:google.co.je, DNS:google.co.jp, 
DNS:google.co.ke, DNS:google.co.kr, DNS:google.co.ls, DNS:google.co.ma, DNS:google.co.mz, 
DNS:google.co.nz, DNS:google.co.th, DNS:google.co.tz, DNS:google.co.ug, DNS:google.co.uk, 
DNS:google.co.uz, DNS:google.co.ve, DNS:google.co.vi, DNS:google.co.za, DNS:google.co.zm, 
DNS:google.co.zw, DNS:google.com.af, DNS:google.com.ag, DNS:google.com.ai, DNS:google.com.ar, 
DNS:google.com.au, DNS:google.com.bd, DNS:google.com.bh, DNS:google.com.bn, DNS:google.com.bo, 
DNS:google.com.br, DNS:google.com.by, DNS:google.com.bz, DNS:google.com.cn, DNS:google.com.co, 
DNS:google.com.cu, DNS:google.com.cy, DNS:google.com.do, DNS:google.com.ec, DNS:google.com.eg, 
DNS:google.com.et, DNS:google.com.fj, DNS:google.com.ge, DNS:google.com.gh, DNS:google.com.gi, 
DNS:google.com.gr, DNS:google.com.gt, DNS:google.com.hk, DNS:google.com.iq, DNS:google.com.jm, 
DNS:google.com.jo, DNS:google.com.kh, DNS:google.com.kw, DNS:google.com.lb, DNS:google.com.ly, 
DNS:google.com.mm, DNS:google.com.mt, DNS:google.com.mx, DNS:google.com.my, DNS:google.com.na, 
DNS:google.com.nf, DNS:google.com.ng, DNS:google.com.ni, DNS:google.com.np, DNS:google.com.nr, 
DNS:google.com.om, DNS:google.com.pa, DNS:google.com.pe, DNS:google.com.pg, DNS:google.com.ph, 
DNS:google.com.pk, DNS:google.com.pl, DNS:google.com.pr, DNS:google.com.py, DNS:google.com.qa, 
DNS:google.com.ru, DNS:google.com.sa, DNS:google.com.sb, DNS:google.com.sg, DNS:google.com.sl, 
DNS:google.com.sv, DNS:google.com.tj, DNS:google.com.tn, DNS:google.com.tr, DNS:google.com.tw, 
DNS:google.com.ua, DNS:google.com.uy, DNS:google.com.vc, DNS:google.com.ve, DNS:google.com.vn, 
DNS:google.cv, DNS:google.cz, DNS:google.de, DNS:google.dj, DNS:google.dk, DNS:google.dm, 
DNS:google.dz, DNS:google.ee, DNS:google.es, DNS:google.fi, DNS:google.fm, DNS:google.fr, 
DNS:google.ga, DNS:google.ge, DNS:google.gg, DNS:google.gl, DNS:google.gm, DNS:google.gp, 
DNS:google.gr, DNS:google.gy, DNS:google.hk, DNS:google.hn, DNS:google.hr, DNS:google.ht, 
DNS:google.hu, DNS:google.ie, DNS:google.im, DNS:google.info, DNS:google.iq, DNS:google.ir, 
DNS:google.is, DNS:google.it, DNS:google.it.ao, DNS:google.je, DNS:google.jo, DNS:google.jobs, 
DNS:google.jp, DNS:google.kg, DNS:google.ki, DNS:google.kz, DNS:google.la, DNS:google.li, 
DNS:google.lk, DNS:google.lt, DNS:google.lu, DNS:google.lv, DNS:google.md, DNS:google.me, 
DNS:google.mg, DNS:google.mk, DNS:google.ml, DNS:google.mn, DNS:google.ms, DNS:google.mu, 
DNS:google.mv, DNS:google.mw, DNS:google.ne, DNS:google.ne.jp, DNS:google.net, DNS:google.ng, 
DNS:google.nl, DNS:google.no, DNS:google.nr, DNS:google.nu, DNS:google.off.ai, DNS:google.pk, 
DNS:google.pl, DNS:google.pn, DNS:google.ps, DNS:google.pt, DNS:google.ro, DNS:google.rs, 
DNS:google.ru, DNS:google.rw, DNS:google.sc, DNS:google.se, DNS:google.sh, DNS:google.si, 
DNS:google.sk, DNS:google.sm, DNS:google.sn, DNS:google.so, DNS:google.sr, DNS:google.st, 
DNS:google.td, DNS:google.tg, DNS:google.tk, DNS:google.tl, DNS:google.tm, DNS:google.tn, 
DNS:google.to, DNS:google.tt, DNS:google.us, DNS:google.uz, DNS:google.vg, DNS:google.vu, 
DNS:google.ws, DNS:googlecommerce.com, DNS:gstatic.com, DNS:urchin.com, DNS:youtu.be, 
DNS:youtube.com, DNS:youtubeeducation.com
 Authority Information Access: 
 CA Issuers - URI:http://pki.google.com/GIAG2.crt
 OCSP - URI:http://clients1.google.com/ocsp

 X509v3 Subject Key Identifier: 
 71:D7:BB:09:DE:42:EB:E5:E0:75:3D:49:64:97:E5:9A:8D:6E:C3:8E
 X509v3 Basic Constraints: critical
 CA:FALSE
 X509v3 Authority Key Identifier: 
 keyid:4A:DD:06:16:1B:BC:F6:68:B5:76:F5:81:B6:BB:62:1A:BA:5A:81:2F

 X509v3 Certificate Policies: 
 Policy: 1.3.6.1.4.1.11129.2.5.1

 X509v3 CRL Distribution Points: 

 Full Name:
 URI:http://pki.google.com/GIAG2.crl

 Signature Algorithm: sha1WithRSAEncryption
 8f:f3:ec:dd:ca:45:d2:20:12:40:cd:ce:72:10:42:b5:ac:4b:
 8c:45:15:15:d7:9f:fb:01:e7:84:63:c6:41:b4:93:8b:79:ab:
 51:56:b9:3f:07:74:5b:c7:38:ad:f0:ee:97:53:3b:f8:2d:bc:
 94:23:ca:2e:1f:0c:5b:21:82:ae:b8:0f:55:43:1a:58:8f:4d:
 25:0a:80:32:a6:c9:ff:3f:43:f5:1f:39:63:9f:a6:82:20:b4:
 74:d4:e1:ef:e0:f9:92:c5:63:b6:e2:61:e4:e7:4e:c7:a3:dd:
 44:1b:32:e0:06:7f:84:b6:45:20:57:6a:71:07:c2:54:b0:69:
 9c:a2:f6:3f:5f:52:ca:9e:ba:77:b3:0b:4f:2a:b7:14:ca:c9:
 7a:6c:f3:ce:2b:aa:c1:0d:ea:33:8f:e6:39:24:83:84:dc:3c:
 ac:f0:83:2e:98:9f:2f:54:de:c4:c5:b0:05:a3:e3:ca:a5:13:
 9c:28:ba:6b:e9:ee:e0:10:41:4a:d7:78:cd:60:0f:79:0f:0a:
 e3:76:46:ce:7a:b4:84:1b:07:91:21:83:23:17:7a:77:e8:32:
 3b:14:7c:3a:a8:fb:d6:c2:bf:18:4a:ad:d7:c1:d6:30:cd:67:
 b4:8f:7d:27:43:97:b8:12:9d:0b:7e:ae:de:27:83:fa:89:29:
 d9:be:e4:43
</code></pre>

blocks|key|153840|text|这可能是因为它正在寻找您站点的SSL证书。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|153841|如果是这种情况，请尝试禁用SSL认证：|153842|$client->setDefaultOption('verify',+false);|code-block|syntax|javascript|153843|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|L|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|M|8|@]|9|@]|A|$G|H]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

It can be that it is looking for the SSL certificate of your site.

If this is the case, try to disable the SSL certification:

<pre><code>$client-&gt;setDefaultOption('verify', false);
</code></pre>

blocks|key|149747|text|这可能可以通过提供适当的CA捆绑包文件来修复，而不是完全禁用验证。请参阅Guzzle文档中的verify。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|149748|在我的系统中，我能够重用与Git捆绑在一起的一个：|149749|$client+=+new+\GuzzleHttp\Client();
$client->setDefaultOption('verify',+'C:\Program+Files+(x86)\Git\bin\curl-ca-bundle.crt');|code-block|syntax|javascript|149750|entityMap|0|LINK|mutability|MUTABLE|url|http://guzzle.readthedocs.io/en/stable/request-options.html#verify^0|1A|6|1A|6|0|0|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@$9|V|A|W|B|C]]|D|@$9|X|A|Y|1|Z]]|E|$]]|$1|F|3|G|5|6|7|10|8|@]|D|@]|E|$]]|$1|H|3|I|5|J|7|11|8|@]|D|@]|E|$K|L]]|$1|M|3|-4|5|6|7|12|8|@]|D|@]|E|$]]]|N|$O|$5|P|Q|R|E|$S|T]]]]

Rather than disabling verification entirely, this can likely be fixed by providing proper CA bundle file. See <a href="http://guzzle.readthedocs.io/en/stable/request-options.html#verify" rel="nofollow noreferrer"><code>verify</code></a> in Guzzle documentation.

In my system I was able to reuse one bundled with Git:

<pre><code>$client = new \GuzzleHttp\Client();
$client-&gt;setDefaultOption('verify', 'C:\Program Files (x86)\Git\bin\curl-ca-bundle.crt');
</code></pre>

blocks|key|2947280|text|对于Guzzle+6%2B，您必须在客户端请求选项数组中设置它。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2947281|$response+=+$client->request('GET',+'https://example.com/v1/WebHooks',+
++++++++++++['verify'+=>+false,
++++++++++++'headers'+=>+['Authorization'+=>+"ApiKey+$apiKey"]
++++++++]);|code-block|syntax|javascript|2947282|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

With Guzzle 6+ you have to set it on the client request options array. 

<pre><code>$response = $client-&gt;request('GET', 'https://example.com/v1/WebHooks', 
 ['verify' =&gt; false,
 'headers' =&gt; ['Authorization' =&gt; "ApiKey $apiKey"]
 ]);
</code></pre>

blocks|key|2734705|text|这对我真的很有帮助|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2734706|点击此链接：http://curl.haxx.se/ca/cacert.pem复制整个页面并将其保存为"cacert.pem“|offset|length|2734707|然后在php.ini文件中插入或编辑|2734708|;;;;;;;;;;;;;;;;;;;;
;+php.ini+Options++;
;;;;;;;;;;;;;;;;;;;;

curl.cainfo+=+"[pathtothisfile]\cacert.pem"|code-block|syntax|javascript|2734709|已解决问题的(在生产环境中不推荐)|style|BOLD|2734710|entityMap|0|LINK|mutability|MUTABLE|url|http://curl.haxx.se/ca/cacert.pem^0|0|6|X|0|0|0|0|6|B|0^^$0|@$1|2|3|4|5|6|7|Y|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Z|8|@]|9|@$D|10|E|11|1|12]]|A|$]]|$1|F|3|G|5|6|7|13|8|@]|9|@]|A|$]]|$1|H|3|I|5|J|7|14|8|@]|9|@]|A|$K|L]]|$1|M|3|N|5|6|7|15|8|@$D|16|E|17|O|P]]|9|@]|A|$]]|$1|Q|3|-4|5|6|7|18|8|@]|9|@]|A|$]]]|R|$S|$5|T|U|V|A|$W|X]]]]

this really helps me 

Follow this link: <a href="http://curl.haxx.se/ca/cacert.pem" rel="nofollow noreferrer">http://curl.haxx.se/ca/cacert.pem</a> Copy the entire page and save it is "cacert.pem"

Then in your php.ini file insert or edit the 

<pre><code>;;;;;;;;;;;;;;;;;;;;
; php.ini Options ;
;;;;;;;;;;;;;;;;;;;;

curl.cainfo = "[pathtothisfile]\cacert.pem"
</code></pre>

Problem solved (Not recommended in a production environment)

blocks|key|2947368|text|您也可以在guzzle+6%2B中尝试此操作|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2947369|$client+=+new+\GuzzleHttp\Client(
++++++++++++++++++array(+
+++++++++++++++++++++++++'curl'+++=>+array(+CURLOPT_SSL_VERIFYPEER+=>+false+),
+++++++++++++++++++++++++'verify'+=>+false
+++++++++++++++++++++++)
+++++++++++++++++++);|code-block|syntax|javascript|2947370|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

you can also try this in guzzle 6+

<pre><code>$client = new \GuzzleHttp\Client(
 array( 
 'curl' =&gt; array( CURLOPT_SSL_VERIFYPEER =&gt; false ),
 'verify' =&gt; false
 )
 );
</code></pre>

blocks|key|152575|text|1)将this+ca+bundle+file的内容保存到您的系统中，例如：C:/ca-bundle.crt|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|152576|2)如下更新php.ini属性openssl.cafile：openssl.cafile="C:/ca-bundle.crt"|BOLD|152577|3)重新启动服务器/完成/现在应该可以工作了|152578|更多信息请点击此处：http://guzzle.readthedocs.io/en/stable/request-options.html#verify|152579|entityMap|0|LINK|mutability|MUTABLE|url|https://raw.githubusercontent.com/bagder/ca-bundle/master/ca-bundle.crt|1|http://guzzle.readthedocs.io/en/stable/request-options.html#verify^0|11|G|3|J|0|0|6|7|U|X|F|E|0|0|A|1U|1|0^^$0|@$1|2|3|4|5|6|7|W|8|@$9|X|A|Y|B|C]]|D|@$9|Z|A|10|1|11]]|E|$]]|$1|F|3|G|5|6|7|12|8|@$9|13|A|14|B|C]|$9|15|A|16|B|C]|$9|17|A|18|B|H]]|D|@]|E|$]]|$1|I|3|J|5|6|7|19|8|@]|D|@]|E|$]]|$1|K|3|L|5|6|7|1A|8|@]|D|@$9|1B|A|1C|1|1D]]|E|$]]|$1|M|3|-4|5|6|7|1E|8|@]|D|@]|E|$]]]|N|$O|$5|P|Q|R|E|$S|T]]|U|$5|P|Q|R|E|$S|V]]]]

1) Save the contents of <a href="https://raw.githubusercontent.com/bagder/ca-bundle/master/ca-bundle.crt" rel="nofollow noreferrer">this ca bundle file</a> to your system, eg to: <code>C:/ca-bundle.crt</code>

2) Update <code>php.ini</code> property openssl.cafile like so: <code>openssl.cafile="C:/ca-bundle.crt"</code>

3) restart server/ done / should now work

more info here: <a href="http://guzzle.readthedocs.io/en/stable/request-options.html#verify" rel="nofollow noreferrer">http://guzzle.readthedocs.io/en/stable/request-options.html#verify</a>

blocks|key|2734733|text|我使用的是guzzle/guzzle+3.*，下面的代码对我有效：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2734734|$client+=+new+Client(env('API_HOST'));
$client->setSslVerification(false);|code-block|syntax|javascript|2734735|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

I use guzzle/guzzle 3.* and this code works for me : 

<pre><code>$client = new Client(env('API_HOST'));
$client-&gt;setSslVerification(false);
</code></pre>

blocks|key|151176|text|最佳选择是|type|unstyled|depth|inlineStyleRanges|entityRanges|data|151177|https://github.com/composer/ca-bundle|offset|length|151178|$client+=+new+\GuzzleHttp\Client([
++++\GuzzleHttp\RequestOptions::VERIFY+=>+\Composer\CaBundle\CaBundle::getSystemCaRootBundlePath()
]);|code-block|syntax|javascript|151179|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|11|0|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|S|8|@]|9|@$D|T|E|U|1|V]]|A|$]]|$1|F|3|G|5|H|7|W|8|@]|9|@]|A|$I|J]]|$1|K|3|-4|5|6|7|X|8|@]|9|@]|A|$]]]|L|$M|$5|N|O|P|A|$Q|C]]]]

The best option is

<a href="https://github.com/composer/ca-bundle" rel="noreferrer">https://github.com/composer/ca-bundle</a>

<pre><code>$client = new \GuzzleHttp\Client([
 \GuzzleHttp\RequestOptions::VERIFY =&gt; \Composer\CaBundle\CaBundle::getSystemCaRootBundlePath()
]);
</code></pre>

blocks|key|2947402|text|Guzzle+6
++$response+=+$client->request('POST',+$url,+[
++++++++++++++++++++++++++++++++++++++++++++++++'verify'+=>+false,
+++++++++++++++++++++++++++++++++++++++++++++++++'body'=>json_encode($postData)
++++++++++++++++++++++++++++++++++++++++++++]);


++++++++++++++++++++$body+=+$response->getBody()->getContents();|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|2947403|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code>Guzzle 6
 $response = $client-&gt;request('POST', $url, [
 'verify' =&gt; false,
 'body'=&gt;json_encode($postData)
 ]);


 $body = $response-&gt;getBody()-&gt;getContents();
</code></pre>

blocks|key|2947417|text|如果你使用的是Facades+Http，那么你可以在withOptions方法中传递verify+false：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2947418|Http::withOptions(['verify'+=>+false,])->withHeaders($headers)->get($endpoint);|offset|length|style|CODE|2947419|entityMap^0|0|0|27|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@$D|L|E|M|F|G]]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

If you are using Facades Http then you can pass verify false in withOptions method : 

<code>Http::withOptions(['verify' =&gt; false,])-&gt;withHeaders($headers)-&gt;get($endpoint);</code>

blocks|key|2734767|text|我在guzzel上也遇到了同样的问题|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2734768|GuzzleHttp\Exception\RequestException::wrapException(Object(GuzzleHttp\Psr7\Request),+Object(RuntimeException))
++++++/mnt/application/lms-backend/vendor/guzzlehttp/guzzle/src/Handler/StreamHandler.php:67

++2+++RuntimeException::("Error+creating+resource:+[message]+fopen():+SSL+operation+failed+with+code+1.+OpenSSL+Error+messages:
error:1408F10B:SSL+routines:ssl3_get_record:wrong+version+number
[file]+/mnt/application/lms-backend/vendor/guzzlehttp/guzzle/src/Handler/StreamHandler.php
[line]+323
[message]+fopen():+Failed+to+enable+crypto
[file]+/mnt/application/lms-backend/vendor/guzzlehttp/guzzle/src/Handler/StreamHandler.php
[line]+323|code-block|syntax|javascript|2734769|请确保您正在使用http请求url，否则将传递pass令牌。|2734770|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

I faced a same issue with guzzel like
<pre><code>GuzzleHttp\Exception\RequestException::wrapException(Object(GuzzleHttp\Psr7\Request), Object(RuntimeException))
 /mnt/application/lms-backend/vendor/guzzlehttp/guzzle/src/Handler/StreamHandler.php:67

 2 RuntimeException::(&quot;Error creating resource: [message] fopen(): SSL operation failed with code 1. OpenSSL Error messages:
error:1408F10B:SSL routines:ssl3_get_record:wrong version number
[file] /mnt/application/lms-backend/vendor/guzzlehttp/guzzle/src/Handler/StreamHandler.php
[line] 323
[message] fopen(): Failed to enable crypto
[file] /mnt/application/lms-backend/vendor/guzzlehttp/guzzle/src/Handler/StreamHandler.php
[line] 323
</code></pre>
Please make sure you are requesting the url with http or else pass the pass token.

blocks|key|2734776|text|$this->client+=+new+Client(
++++[
+++++++'base_uri'+=>+$this->baseUrl,
+++++++'verify'+=>+false,
+++]
);|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|2734777|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code>$this-&gt;client = new Client(
 [
 'base_uri' =&gt; $this-&gt;baseUrl,
 'verify' =&gt; false,
 ]
);
</code></pre>

Trying to use the YouTube API v3 to get some video(s) information, using Guzzle in Symfony2 using Service Descriptors. 

When I run the script, I get this:

<blockquote>
 [curl] 60: SSL certificate problem: unable to get local issuer
 certificate [url]
 <a href="https://www.googleapis.com/youtube/v3/videos?id=2xbVbCoHBgA&amp;part=snippet&amp;key=" rel="noreferrer">https://www.googleapis.com/youtube/v3/videos?id=2xbVbCoHBgA&amp;part=snippet&amp;key=</a>{MY_KEY}
 
 500 Internal Server Error - CurlException
</blockquote>

My descriptor looks like this:

<pre><code>{
 "name": "YouTube",
 "baseUrl": "https://www.googleapis.com",
 "apiVersion": "v3",
 "description": "YouTube GData Graph API",
 "operations": {
 "GetVideos": {
 "httpMethod": "GET",
 "uri": "/youtube/v3/videos",
 "parameters": {
 "id": {
 "type":"string",
 "location":"query",
 "required": true
 },
 "part": {
 "location": "query",
 "default": "snippet"
 },
 "key": {
 "location": "query",
 "default": "{MY KEY}",
 "static": true
 },
 "maxResults": {
 "location": "query",
 "default": 50
 }
 }
 }
 }
}
</code></pre>

This is running on a local Ubuntu 14.04 development environment with a very basic LAMP stack going on.

Any ideas as to what might be causing this?

Guzzle Curl Error 60 SSL unable to get local issuer

LAMP堆栈

服务器

Ubuntu

尝试使用YouTube应用程序接口v3获取一些视频信息，在Symfony2中使用Guzzle并使用服务描述符。当我运行这个脚本时，我得到的结果是： curl 60: SSL证书问题:无法获取本地颁发者证书{MY_KEY}500内部服务器错误- CurlException我的描述符如下所示：{    "name": "Y...

问Guzzle卷曲错误60 SSL无法获取本地颁发者
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Guzzle卷曲错误60 SSL无法获取本地颁发者EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Guzzle卷曲错误60 SSL无法获取本地颁发者
EN