blocks|key|1524064|text|curl过去常常包含一个可接受证书颁发机构(+CA+)的列表，但自7.18.1及以后不再绑定任何CA证书。因此，默认情况下，它将拒绝所有TLS/SSL证书作为不可验证的证书。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1524065|你必须得到你的CA的根证书，并指向它的卷曲。在curl's+有关TLS/SSL证书验证的详细信息上有更多的细节。|1524066|entityMap|0|LINK|mutability|MUTABLE|url|https://curl.se/docs/sslcerts.html^0|0|4|0|U|I|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@$9|Q|A|R|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|S|8|@]|D|@$9|T|A|U|1|V]]|E|$]]|$1|H|3|-4|5|6|7|W|8|@]|D|@]|E|$]]]|I|$J|$5|K|L|M|E|$N|O]]]]

<code>curl</code> used to include a list of accepted certificate authorities (CAs) but no longer bundles ANY CA certs since 7.18.1 and onwards. So by default it'll reject all TLS/SSL certificates as unverifiable.
You'll have to get your CA's root certificate and point curl at it. More details at curl's <a href="https://curl.se/docs/sslcerts.html" rel="nofollow noreferrer">details on TLS/SSL certificates verification</a>.

blocks|key|2720608|text|警告:这可能会引入SSL设计来保护的安全问题，从而使您的整个代码库不安全。这违反了所有推荐的实践。。|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|2720609|但对我来说，一个很简单的解决办法是打电话给：|2720610|curl_setopt($ch,+CURLOPT_SSL_VERIFYPEER,+false);|code-block|syntax|javascript|2720611|在打电话之前：|2720612|curl_exec():|2720613|在php文件中。|2720614|我认为这将禁用SSL证书的所有验证。|2720615|entityMap^0|0|1D|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|W|8|@$9|X|A|Y|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|Z|8|@]|D|@]|E|$]]|$1|H|3|I|5|J|7|10|8|@]|D|@]|E|$K|L]]|$1|M|3|N|5|6|7|11|8|@]|D|@]|E|$]]|$1|O|3|P|5|J|7|12|8|@]|D|@]|E|$K|L]]|$1|Q|3|R|5|6|7|13|8|@]|D|@]|E|$]]|$1|S|3|T|5|6|7|14|8|@]|D|@]|E|$]]|$1|U|3|-4|5|6|7|15|8|@]|D|@]|E|$]]]|V|$]]

Warning: this can introduce security issues that SSL is designed to protect against, rendering your entire codebase insecure. It goes against every recommended practice.

But a really simple fix that worked for me was to call:

<pre><code>curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
</code></pre>

before calling:

<pre><code>curl_exec():
</code></pre>

in the php file.

I believe that this disables all verification of SSL certificates.

blocks|key|1524154|text|资料来源：+http://ademar.name/blog/2006/04/curl-ssl-certificate-problem-v.html|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|1524155|#Curl:+SSL证书问题，请验证CA证书是OK#+###07+4月2006###
使用Curl打开安全url时，可能会出现以下错误：
SSL证书问题，请验证CA证书是否正常。
我会解释错误的原因以及你应该做些什么。
消除错误的最简单方法是将以下两行添加到脚本中。这一解决方案构成了安全风险。
//警告:这将防止卷曲检测到‘中间人’攻击curl_setopt+($ch，CURLOPT_SSL_VERIFYHOST，0)；curl_setopt+($ch，CURLOPT_SSL_VERIFYPEER，0)；
让我们看看这两个参数的作用。引用手册。
CURLOPT_SSL_VERIFYHOST：1以检查SSL证书中是否存在公共名称。2检查公用名称是否存在，并验证其是否与所提供的主机名匹配。
CURLOPT_SSL_VERIFYPEER：FALSE，以阻止CURL验证对等方的证书。可以使用CURLOPT_CAINFO选项指定要验证的备用证书，也可以使用CURLOPT_CAPATH选项指定证书目录。如果禁用CURLOPT_SSL_VERIFYHOST+(默认为2)，则CURLOPT_SSL_VERIFYPEER也可能需要为TRUE或FALSE。将CURLOPT_SSL_VERIFYHOST设置为2(这是默认值)将保证所呈现给您的证书具有与您用于访问远程资源的URN相匹配的“公共名称”。这是一个健康的检查，但它并不保证你的计划是不确定的。
###Enter‘男人在中间’#
您的程序可能会被误导，转而与另一台服务器对话。这可以通过几种机制来实现，比如dns或arp中毒(这是另一天的故事)。入侵者也可以用你的程序所期望的相同的“comon名称”自我签署证书。通信仍然是加密的，但你会把你的秘密泄露给一个冒名顶替者。这种攻击叫做“中间的人”。
###Defeating‘男人在中间’#
好的，我们需要确认提交给我们的证书是真实的。我们通过将它与我们合理的*信任的证书进行比较来做到这一点。
如果远程资源受到主要CA之一所颁发的证书的保护，如GeoTrust等，则可以安全地与http://curl.se/docs/caextract.html中的Mozilla的CA证书包进行比较。
将文件cacert.pem保存在服务器的某个位置，并在脚本中设置以下选项。
curl_setopt+($ch，CURLOPT_SSL_VERIFYPEER，TRUE)；curl_setopt+($ch，CURLOPT_CAINFO，“pathto/acert.pem”)；|blockquote|CODE|1524156|对于以上所有信息，信用额度为：http://ademar.name/blog/2006/04/curl-ssl-certificate-problem-v.html。|1524157|entityMap|0|LINK|mutability|MUTABLE|url|http://ademar.name/blog/2006/04/curl-ssl-certificate-problem-v.html|1|http://curl.se/docs/caextract.html|2^0|0|5|6|1V|0|0|7O|M|9O|M|QD|A|OR|Y|1|0|F|1V|2|0^^$0|@$1|2|3|4|5|6|7|W|8|@$9|X|A|Y|B|C]]|D|@$9|Z|A|10|1|11]]|E|$]]|$1|F|3|G|5|H|7|12|8|@$9|13|A|14|B|C]|$9|15|A|16|B|C]|$9|17|A|18|B|I]]|D|@$9|19|A|1A|1|1B]]|E|$]]|$1|J|3|K|5|6|7|1C|8|@]|D|@$9|1D|A|1E|1|1F]]|E|$]]|$1|L|3|-4|5|6|7|1G|8|@]|D|@]|E|$]]]|M|$N|$5|O|P|Q|E|$R|S]]|T|$5|O|P|Q|E|$R|U]]|V|$5|O|P|Q|E|$R|S]]]]

Source: <a href="http://ademar.name/blog/2006/04/curl-ssl-certificate-problem-v.html" rel="nofollow noreferrer">http://ademar.name/blog/2006/04/curl-ssl-certificate-problem-v.html</a>
<blockquote>
#Curl: SSL certificate problem, verify that the CA cert is OK#
###07 April 2006###
When opening a secure url with Curl you may get the following error:
SSL certificate problem, verify that the CA cert is OK
I will explain why the error and what you should do about it.
The easiest way of getting rid of the error would be adding the
following two lines to your script . This solution poses a security
risk tho.
<pre><code>//WARNING: this would prevent curl from detecting a 'man in the middle' attack
curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0); 
</code></pre>
Let see what this two parameters do. Quoting the manual.
CURLOPT_SSL_VERIFYHOST: 1 to check the existence of a common name in the SSL peer certificate. 2 to check the existence of a common name
and also verify that it matches the hostname provided.
CURLOPT_SSL_VERIFYPEER: FALSE to stop CURL from verifying the peer's certificate. Alternate certificates to verify against can be
specified with the CURLOPT_CAINFO option or a certificate directory
can be specified with the CURLOPT_CAPATH option.
CURLOPT_SSL_VERIFYHOST may also need to be TRUE or FALSE if
CURLOPT_SSL_VERIFYPEER is disabled (it defaults to 2). Setting
CURLOPT_SSL_VERIFYHOST to 2 (This is the default value) will garantee
that the certificate being presented to you have a 'common name'
matching the URN you are using to access the remote resource. This is
a healthy check but it doesn't guarantee your program is not being
decieved.
###Enter the 'man in the middle'###
Your program could be misleaded into talking to another server
instead. This can be achieved through several mechanisms, like dns or
arp poisoning ( This is a story for another day). The intruder can
also self-sign a certificate with the same 'comon name' your program
is expecting. The communication would still be encrypted but you would
be giving away your secrets to an impostor. This kind of attack is
called 'man in the middle'
###Defeating the 'man in the middle'###
Well, we need to to verify the certificate being presented to us is
good for real. We do this by comparing it against a certificate we
reasonable* trust.
If the remote resource is protected by a certificate issued by one of
the main CA's like Verisign, GeoTrust et al, you can safely compare
against Mozilla's CA certificate bundle which you can get from
<a href="http://curl.se/docs/caextract.html" rel="nofollow noreferrer">http://curl.se/docs/caextract.html</a>
Save the file <code>cacert.pem</code> somewhere in your server and set the
following options in your script.
<pre><code>curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, TRUE); 
curl_setopt ($ch, CURLOPT_CAINFO, &quot;pathto/cacert.pem&quot;);
</code></pre>
</blockquote>
for All above Info Credit Goes to : <a href="http://ademar.name/blog/2006/04/curl-ssl-certificate-problem-v.html" rel="nofollow noreferrer">http://ademar.name/blog/2006/04/curl-ssl-certificate-problem-v.html</a>

blocks|key|1524194|text|这在Windows中是一个很常见的问题。您只需将cacert.pem设置为curl.cainfo即可。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1524195|因为PHP+5.3.7您可以这样做：|1524196|下载https://curl.se/ca/cacert.pem并将其保存在某个地方。|ordered-list-item|1524197|更新php.ini+-添加curl.cainfo+=“PATH_TO/acert.pem”|1524198|否则，您将需要对每个cURL资源执行以下操作：|1524199|curl_setopt+($ch,+CURLOPT_CAINFO,+"PATH_TO/cacert.pem");|code-block|syntax|javascript|1524200|entityMap|0|LINK|mutability|MUTABLE|url|https://curl.se/ca/cacert.pem^0|O|A|11|B|0|0|2|T|0|0|2|7|0|0|0^^$0|@$1|2|3|4|5|6|7|11|8|@$9|12|A|13|B|C]|$9|14|A|15|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|16|8|@]|D|@]|E|$]]|$1|H|3|I|5|J|7|17|8|@]|D|@$9|18|A|19|1|1A]]|E|$]]|$1|K|3|L|5|J|7|1B|8|@$9|1C|A|1D|B|C]]|D|@]|E|$]]|$1|M|3|N|5|6|7|1E|8|@]|D|@]|E|$]]|$1|O|3|P|5|Q|7|1F|8|@]|D|@]|E|$R|S]]|$1|T|3|-4|5|6|7|1G|8|@]|D|@]|E|$]]]|U|$V|$5|W|X|Y|E|$Z|10]]]]

It's a pretty common problem in Windows. You need just to set <code>cacert.pem</code> to <code>curl.cainfo</code>.
Since PHP 5.3.7 you could do:
<ol>
<li>download <a href="https://curl.se/ca/cacert.pem" rel="nofollow noreferrer">https://curl.se/ca/cacert.pem</a> and save it somewhere.</li>
<li>update <code>php.ini</code> -- add curl.cainfo = &quot;PATH_TO/cacert.pem&quot;</li>
</ol>
Otherwise you will need to do the following for every cURL resource:
<pre><code>curl_setopt ($ch, CURLOPT_CAINFO, &quot;PATH_TO/cacert.pem&quot;);
</code></pre>

blocks|key|1524231|text|有时，如果您试图联系的应用程序具有自签名证书，则来自http://curl.haxx.se/ca/cacert.pem的普通http://curl.haxx.se/ca/cacert.pem无法解决此问题。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1524232|如果您确信服务端点url，通过浏览器点击它，手动保存证书以"X+509证书带链(PEM)“格式。将此证书文件指向|1524233|curl_setopt+($ch,+CURLOPT_CAINFO,+"pathto/{downloaded+certificate+chain+file}");+++|code-block|syntax|javascript|1524234|entityMap|0|LINK|mutability|MUTABLE|url|http://curl.haxx.se/ca/cacert.pem|1^0|Q|X|0|1Q|X|1|0|0|0^^$0|@$1|2|3|4|5|6|7|T|8|@]|9|@$A|U|B|V|1|W]|$A|X|B|Y|1|Z]]|C|$]]|$1|D|3|E|5|6|7|10|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|11|8|@]|9|@]|C|$I|J]]|$1|K|3|-4|5|6|7|12|8|@]|9|@]|C|$]]]|L|$M|$5|N|O|P|C|$Q|R]]|S|$5|N|O|P|C|$Q|R]]]]

Sometimes if the application you try to contact has self signed certificates, the normal cacert.pem from <a href="http://curl.haxx.se/ca/cacert.pem" rel="nofollow">http://curl.haxx.se/ca/cacert.pem</a> does not solve the problem.

If you are sure about the service endpoint url, hit it through browser, save the certificate manually in "X 509 certificate with chain (PEM)" format. Point this certificate file with the 

<pre><code>curl_setopt ($ch, CURLOPT_CAINFO, "pathto/{downloaded certificate chain file}"); 
</code></pre>

blocks|key|1524240|text|解决办法很简单！将这一行放在curl_exec之前|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1524241|curl_setopt($ch,+CURLOPT_SSL_VERIFYPEER,+false);|code-block|syntax|javascript|1524242|对我来说很管用。|1524243|entityMap^0|E|9|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@$9|P|A|Q|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|R|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|S|8|@]|D|@]|E|$]]|$1|M|3|-4|5|6|7|T|8|@]|D|@]|E|$]]]|N|$]]

The solution is very simple! Put this line before <code>curl_exec</code>:

<pre><code>curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
</code></pre>

For me it works.

blocks|key|3079169|text|当为CURLOPT_CAINFO设置curl选项时，请记住使用单引号，使用双引号只会导致另一个错误。因此，您的选项应该是：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3079170|curl_setopt+($ch,+CURLOPT_CAINFO,+'c:\wamp\www\mywebfolder\cacert.pem');|code-block|syntax|javascript|3079171|此外，在您的php.ini文件设置中应该写成：(注意我的双引号)|3079172|curl.cainfo+=+"C:\wamp\www\mywebfolder"|3079173|我把它直接放在写着：extension=php_curl.dll的线下面|offset|length|style|CODE|3079174|(仅为组织目的，您可以将其放置在php.ini中的任何地方，我只需将其放在接近另一个curl引用的位置，因此当我使用关键字curl搜索时，可以在一个区域找到两个curl引用。)|3079175|entityMap^0|0|0|0|0|A|M|0|G|7|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|V|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|W|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|X|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|Y|8|@$M|Z|N|10|O|P]]|9|@]|A|$]]|$1|Q|3|R|5|6|7|11|8|@$M|12|N|13|O|P]]|9|@]|A|$]]|$1|S|3|-4|5|6|7|14|8|@]|9|@]|A|$]]]|T|$]]

When setting the curl options for CURLOPT_CAINFO please remember to use single quotes, using double quotes will only cause another error. So your option should look like:

<pre><code>curl_setopt ($ch, CURLOPT_CAINFO, 'c:\wamp\www\mywebfolder\cacert.pem');
</code></pre>

Additionally, in your php.ini file setting should be written as:(notice my double quotes)

<pre><code>curl.cainfo = "C:\wamp\www\mywebfolder"
</code></pre>

I put it directly below the line that says this: <code>extension=php_curl.dll</code>

(For organizing purposes only, you could put it anywhere within your <code>php.ini</code>, i just put it close to another curl reference so when I search using keyword curl I caan find both curl references in one area.)

blocks|key|1524279|text|我在amazon上也有同样的错误。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1524280|我通过在/etc/php.d/curl.ini上设置curl.cainfo来解决问题。|offset|length|style|BOLD|1524281|https://gist.github.com/reinaldomendes/97fb2ce8a606ec813c4b|1524282|添加2018年10月|1524283|在Amazon+v1上编辑这个文件|1524284|vi+/etc/php.d/20-curl.ini|code-block|syntax|javascript|1524285|若要添加此行，请执行以下操作|1524286|curl.cainfo="/etc/ssl/certs/ca-bundle.crt"|1524287|entityMap|0|LINK|mutability|MUTABLE|url^0|0|4|J|Q|B|0|0|1N|0|0|0|A|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|13|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|14|8|@$D|15|E|16|F|G]|$D|17|E|18|F|G]]|9|@]|A|$]]|$1|H|3|I|5|6|7|19|8|@]|9|@$D|1A|E|1B|1|1C]]|A|$]]|$1|J|3|K|5|6|7|1D|8|@$D|1E|E|1F|F|G]]|9|@]|A|$]]|$1|L|3|M|5|6|7|1G|8|@]|9|@]|A|$]]|$1|N|3|O|5|P|7|1H|8|@]|9|@]|A|$Q|R]]|$1|S|3|T|5|6|7|1I|8|@]|9|@]|A|$]]|$1|U|3|V|5|P|7|1J|8|@]|9|@]|A|$Q|R]]|$1|W|3|-4|5|6|7|1K|8|@]|9|@]|A|$]]]|X|$Y|$5|Z|10|11|A|$12|I]]]]

I have the same error on amazon AMI linux.

I Solved by setting curl.cainfo on /etc/php.d/curl.ini

<a href="https://gist.github.com/reinaldomendes/97fb2ce8a606ec813c4b" rel="nofollow noreferrer">https://gist.github.com/reinaldomendes/97fb2ce8a606ec813c4b</a>

Addition October 2018

On Amazon Linux v1 edit this file

<pre><code>vi /etc/php.d/20-curl.ini
</code></pre>

To add this line

<pre><code>curl.cainfo="/etc/ssl/certs/ca-bundle.crt"
</code></pre>

blocks|key|2720827|text|为了所有神圣的爱..。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2720828|在我的例子中，我必须将openssl.cafile+PHP变量设置为PEM路径。|offset|length|style|CODE|2720829|我相信很多系统都确实需要在PHP中设置curl.cainfo，但在我所使用的环境中，也就是eboraas/laravel停靠容器，它使用Debian8+(jessie)和PHP5.6，设置该变量并不奏效。|2720830|我注意到php+-i的输出没有提到任何关于特定配置设置的内容，但是它确实有一些关于openssl的行。这里有一个openssl.capath和openssl.cafile选项，但只需设置第二个选项，就可以通过PHP进行curl操作，最终可以使用HTTPS。|2720831|entityMap|0|LINK|mutability|MUTABLE|url|https://hub.docker.com/r/eboraas/laravel/^0|0|B|E|0|J|B|19|F|0|0|4|6|15|7|1K|E|1Z|E|0^^$0|@$1|2|3|4|5|6|7|T|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|U|8|@$D|V|E|W|F|G]]|9|@]|A|$]]|$1|H|3|I|5|6|7|X|8|@$D|Y|E|Z|F|G]]|9|@$D|10|E|11|1|12]]|A|$]]|$1|J|3|K|5|6|7|13|8|@$D|14|E|15|F|G]|$D|16|E|17|F|G]|$D|18|E|19|F|G]|$D|1A|E|1B|F|G]]|9|@]|A|$]]|$1|L|3|-4|5|6|7|1C|8|@]|9|@]|A|$]]]|M|$N|$5|O|P|Q|A|$R|S]]]]

For the love of all that is holy...

In my case, I had to set the <code>openssl.cafile</code> PHP config variable to the PEM file path.

I trust it is very true that there are many systems where setting <code>curl.cainfo</code> in PHP's config is exactly what is needed, but in the environment I'm working with, which is the <a href="https://hub.docker.com/r/eboraas/laravel/" rel="nofollow noreferrer">eboraas/laravel</a> docker container, which uses Debian 8 (jessie) and PHP 5.6, setting that variable did not do the trick.

I noticed that the output of <code>php -i</code> did not mention anything about that particular config setting, but it did have a few lines about <code>openssl</code>. There is both an <code>openssl.capath</code> and <code>openssl.cafile</code> option, but just setting the second one allowed curl via PHP to finally be okay with HTTPS URLs.

blocks|key|3079249|text|当我试图让GuzzleHttp+(php%2Bapache+on+Mac)从www.googleapis.com获得一个页面时，我来到了这里。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3079250|这是我的最后一个解决办法，以防对任何人有帮助。|3079251|查看证书链中的任何域给您此错误。对我来说是googleapis.com|3079252|openssl+s_client+-host+www.googleapis.com+-port+443|code-block|syntax|javascript|3079253|你会得到这样的东西：|3079254|Certificate+chain
+0+s:/C=US/ST=California/L=Mountain+View/O=Google+Inc/CN=*.googleapis.com
+++i:/C=US/O=Google+Inc/CN=Google+Internet+Authority+G2
+1+s:/C=US/O=Google+Inc/CN=Google+Internet+Authority+G2
+++i:/C=US/O=GeoTrust+Inc./CN=GeoTrust+Global+CA
+2+s:/C=US/O=GeoTrust+Inc./CN=GeoTrust+Global+CA
+++i:/C=US/O=Equifax/OU=Equifax+Secure+Certificate+Authority|3079255|注意:在我解决了问题后，我捕捉到了这个问题，到你的链式输出看起来可能不一样。|3079256|然后，您需要查看php中允许的证书。在页面中运行phpinfo()。|3079257|<?php+echo+phpinfo();|3079258|然后查找从页面输出加载的证书文件：|3079259|openssl.cafile++/usr/local/php5/ssl/certs/cacert.pem|3079260|这是您需要通过向其添加正确的证书来修复的文件。|3079261|sudo+nano+/usr/local/php5/ssl/certs/cacert.pem|3079262|您基本上需要将正确的证书“签名”附加到该文件的末尾。|3079263|您可以在这里找到其中的一些:如果需要的话，您可能需要搜索/搜索链中的其他人。|3079264|https://pki.google.com/|unordered-list-item|offset|length|3079265|https://www.geotrust.com/resources/root-certificates/index.html|3079266|它们看起来是这样的：|3079267|​|3079268|📷|atomic|3079269|3079270|(注意:这是一个图像，所以人们不会简单地从堆栈溢出复制/粘贴证书)|3079271|一旦正确的证书在这个文件中，重新启动apache并进行测试。|3079272|entityMap|0|LINK|mutability|MUTABLE|url|1|2|IMAGE|IMMUTABLE|imageUrl|https://developer.qcloudimg.com/http-save/yehe-900000/800f80ed92f56dbd4cde49ce938f0a74.png|imageAlt^0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|N|0|0|0|1R|1|0|0|0|0|1|2|0|0|0|0^^$0|@$1|2|3|4|5|6|7|23|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|24|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|25|8|@]|9|@]|A|$]]|$1|F|3|G|5|H|7|26|8|@]|9|@]|A|$I|J]]|$1|K|3|L|5|6|7|27|8|@]|9|@]|A|$]]|$1|M|3|N|5|H|7|28|8|@]|9|@]|A|$I|J]]|$1|O|3|P|5|6|7|29|8|@]|9|@]|A|$]]|$1|Q|3|R|5|6|7|2A|8|@]|9|@]|A|$]]|$1|S|3|T|5|H|7|2B|8|@]|9|@]|A|$I|J]]|$1|U|3|V|5|6|7|2C|8|@]|9|@]|A|$]]|$1|W|3|X|5|H|7|2D|8|@]|9|@]|A|$I|J]]|$1|Y|3|Z|5|6|7|2E|8|@]|9|@]|A|$]]|$1|10|3|11|5|H|7|2F|8|@]|9|@]|A|$I|J]]|$1|12|3|13|5|6|7|2G|8|@]|9|@]|A|$]]|$1|14|3|15|5|6|7|2H|8|@]|9|@]|A|$]]|$1|16|3|17|5|18|7|2I|8|@]|9|@$19|2J|1A|2K|1|2L]]|A|$]]|$1|1B|3|1C|5|18|7|2M|8|@]|9|@$19|2N|1A|2O|1|2P]]|A|$]]|$1|1D|3|1E|5|6|7|2Q|8|@]|9|@]|A|$]]|$1|1F|3|1G|5|6|7|2R|8|@]|9|@]|A|$]]|$1|1H|3|1I|5|1J|7|2S|8|@]|9|@$19|2T|1A|2U|1|2V]]|A|$]]|$1|1K|3|1G|5|6|7|2W|8|@]|9|@]|A|$]]|$1|1L|3|1M|5|6|7|2X|8|@]|9|@]|A|$]]|$1|1N|3|1O|5|6|7|2Y|8|@]|9|@]|A|$]]|$1|1P|3|-4|5|6|7|2Z|8|@]|9|@]|A|$]]]|1Q|$1R|$5|1S|1T|1U|A|$1V|17]]|1W|$5|1S|1T|1U|A|$1V|1C]]|1X|$5|1Y|1T|1Z|A|$20|21|22|-4]]]]

I ended up here when trying to get GuzzleHttp (php+apache on Mac) to get a page from www.googleapis.com. 

Here was my final solution in case it helps anyone. 

Look at the certificate chain for whatever domain is giving you this error. For me it was googleapis.com

<pre><code>openssl s_client -host www.googleapis.com -port 443
</code></pre>

You'll get back something like this:

<pre><code>Certificate chain
 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=*.googleapis.com
 i:/C=US/O=Google Inc/CN=Google Internet Authority G2
 1 s:/C=US/O=Google Inc/CN=Google Internet Authority G2
 i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
 i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
</code></pre>

Note: I captured this after I fixed the issue, to your chain output may look different.

Then you need to look at the certificates allowed in php. Run phpinfo() in a page.

<pre><code>&lt;?php echo phpinfo();
</code></pre>

Then look for the certificate file that's loaded from the page output:

<pre><code>openssl.cafile /usr/local/php5/ssl/certs/cacert.pem
</code></pre>

This is the file you'll need to fix by adding the correct certificate(s) to it.

<pre><code>sudo nano /usr/local/php5/ssl/certs/cacert.pem
</code></pre>

You basically need to append the correct certificate "signatures" to the end of this file.

You can find some of them here: You may need to google/search for others in the chain if you need them.

<ul>
<li><a href="https://pki.google.com/" rel="nofollow noreferrer">https://pki.google.com/</a></li>
<li><a href="https://www.geotrust.com/resources/root-certificates/index.html" rel="nofollow noreferrer">https://www.geotrust.com/resources/root-certificates/index.html</a></li>
</ul>

They look like this:

<a href="https://i.stack.imgur.com/OBrPr.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/OBrPr.png" alt="example certificate image"></a>

(Note: This is an image so people will not simply copy/paste certificates from stackoverflow)

Once the right certificates are in this file, restart apache and test.

blocks|key|3079288|text|您可以尝试重新安装ca-certificates包，或者按照描述的这里显式允许出现问题的证书。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|3079289|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/a/55639038/1524303^0|9|F|X|2|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@$9|O|A|P|B|C]]|D|@$9|Q|A|R|1|S]]|E|$]]|$1|F|3|-4|5|6|7|T|8|@]|D|@]|E|$]]]|G|$H|$5|I|J|K|E|$L|M]]]]

You could try to reinstall the <code>ca-certificates</code> package, or explicitly allow the certificate in question as described <a href="https://stackoverflow.com/a/55639038/1524303">here</a>.

I am using <a href="http://www.apachefriends.org" rel="noreferrer">XAMPP</a> for development. Recently I upgraded my installation of xampp from an old version to 1.7.3. 

Now when I curl HTTPS enabled sites I get the following exception

<blockquote>
 Fatal error: Uncaught exception 'RequestCore_Exception' with message
 'cURL resource: Resource
 id #55; cURL error: SSL certificate problem, verify that the CA cert is OK. Details:
 error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (60)'
</blockquote>

Everyone suggest using some specific curl options from PHP code to fix this problem. I think this shouldn't be the way. Because I didn't have any problem with my old version of XAMPP and happened only after installing the new version. 

I need help to figure out what settings change in my PHP installation, Apache etc can fix this problem.

HTTPS and SSL3_GET_SERVER_CERTIFICATE:certificate verify failed, CA is OK

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我正在使用进行开发。最近，我将xampp的安装从旧版本升级到1.7.3。现在，当我对启用HTTPS的站点进行压缩时，我会得到以下异常致命错误:带有消息‘routines:SSL3_GET_SERVER_CERTIFICATE:certificate资源:资源id #55；cURL错误: SSL证书问题的未命名异常'Re...

问HTTPS和SSL3_GET_SERVER_CERTIFICATE:certificate验证失败，CA没有问题
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问HTTPS和SSL3_GET_SERVER_CERTIFICATE:certificate验证失败，CA没有问题EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问HTTPS和SSL3_GET_SERVER_CERTIFICATE:certificate验证失败，CA没有问题
EN