AWS的PHP CURL错误

Question

I am experiencing a very strange error with AWS and the PHP SDK. I am able to connect to S3 with my PHP code and store objects in my bucket when using my local server on my laptop. I am also able to connect to S3 on our test/staging server. However, on our production server, I keep getting the following error when I try to connect:

cURL resource: Resource id #8; cURL error: Problem with the SSL CA cert (path? access rights?) (77)

I have tried adding this line in the config.inc.php file for AWS SDK, which was a solution mentioned in the AWS forums:

define('AWS_CERTIFICATE_AUTHORITY', true);

But the error still persists. Any idea what may be wrong or how I can trouble shoot something like this?

Here's what it says in the Apache error log:

About to connect() to mydb.s3.amazonaws.com port 443 (#0) * Trying 223.33.211.223... * connected * Connected to mydb.s3.amazonaws.com (223.33.211.223) port 443 (#0) * Initializing NSS with certpath: /etc/pki/nssdb * Unable to initialize NSS database * NSS error -8023 * Closing connection #0 * Problem with the SSL CA cert (path? access rights?)

Cheers!

Answer 1

In the code itself we can add the following line to avoid the fatal error for testing purpose.

error_reporting(E_WARNING);

$s3 = new AmazonS3();
$s3->disable_ssl();
$s3->disable_ssl_verification();

Otherwise we will add the following line in our php.ini file at the end for SSL Certificate.

[PHP]
curl.cainfo = "C:\xampp\htdocs\aws\sdk\lib\requestcore\cacert.pem"

Answer 2

Turns out there was a problem with the NSS database. The apache error logs were showing this:

Initializing NSS with certpath: /etc/pki/nssdb * Unable to initialize NSS database * NSS error -8023

After generating a new NSS database and re-starting apache, the problem was resolved.

Answer 3

Also in version 1.5, they came out with an entirely new format for the config.inc.php file. It's really nice if you manage multiple sets of credentials.

• New config-sample.inc.php for version 1.5
• Setting up credential sets
• Using credential sets