CURL错误：SSL证书错误：证书链中的自签名证书

Question

I am getting the above error unless I set the following:

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

which is insecure and defeats the purpose of SSL.

I have downloaded the most recent cacert.pem certificate from https://curl.haxx.se/ca/cacert.pem .

I have set the following in php.ini and restarted apache.

curl.cainfo = /etc/ssl/cacert.pem

Which produced the same error. So I tried to set at runtime with:

curl_setopt($curl,CURLOPT_CAINFO, "/etc/ssl/cacert.pem");

and still getting the same error.

Answer 1

In case of SSL certificates signed by any Certification Authority (CA), the client app (eg browser) verify the SSL certificate with CA. CA tells the client that whether it is a trusted server or not.

When you are using self signed certificates and not using this option

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

you will get error because, your client app will try to verify your self signed SSL certificate with Certification Authority and CA will give error because it's a self signed certificate.

This is the reason we have to use this option to skip the SSL certificate validation step.