php imap函数与cronjob

Question

I have a php script with imap functions. All is fine when I call the php file from browser, but when it run with cronjob the following error:

    X-Powered-By: PHP/5.3.27
    Set-Cookie: bgm=31dc5ff02b6a3d1614a9dd1c39321fd0; path=/
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
    Pragma: no-cache
    Content-type: text/html

    <br />
    <b>Warning</b>:  imap_open() [<a href='function.imap-open'>function.imap-open</a>]: Couldn't open stream {"hostname":993/imap/notls/ssl} in <b>/"path"/cron.php</b> on line <b>173</b><br /> 
    <br/><br/><span style='color:red'></span><pre>Certificate failure for "hostname": unable to get local issuer certificate: /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA</pre><br/><br/><br />

OS: CentOS 5.9 The cronjob was created with Cpanel: /usr/bin/php file.php. The imap_last_error() give the following error: Certificate failure for "hostname" : unable to get local issuer certificate: But when i call the cron.php from any browser that certificate failure doesn't come and all works fine.

Answer 1

OpenSSL takes the CA bundle file location / CA directory location either as a parameter (command line or library method call) or from the environment variables SSL_CERT_FILE / SSL_CERT_DIR.

My guess is in this case the Apache environment had one of these set correctly and the cron environment did not. Two solutions:

1. set one of these env variables at the top of the crontab:

SSL_CERT_FILE="/path/to/ca-bundle.crt"

2. set the env variable in the php script before opening imap connection:

putenv('SSL_CERT_FILE=/usr/share/ssl/certs/ca-bundle.crt');

Thank you to @Daniel-Roethlisberger for inspiring me to find this second solution based on his solution in Ruby: https://stackoverflow.com/a/14797635/2294879

I think also it must be possible to specify a default bundle location in the build of the imap program/library that PHP uses (because my imap connection used to work fine before applying the above), but this is surely more hassle.

Answer 2

It seems as if PHP is unable to verify the certificate. Can you check whether it works when adding /novalidate-cert to the resource URL?