PHP - SSL 证书错误：无法获取本地颁发者证书

PHP - SSL certificate error: unable to get local issuer certificate

提问by Dor Dadush

I'm running PHP Version 5.6.3 as part of XAMPP on Windows 7.

我在 Windows 7 上运行 PHP 版本 5.6.3 作为 XAMPP 的一部分。

When I try to use the Mandrill API, I'm getting the following error:

当我尝试使用 Mandrill API 时，出现以下错误：

Uncaught exception 'Mandrill_HttpError' with message 'API call to messages/send-template failed: SSL certificate problem: unable to get local issuer certificate'

未捕获的异常“Mandrill_HttpError”，消息为“API 调用消息/发送模板失败：SSL 证书问题：无法获得本地颁发者证书”

I already tried everything I read on StackOverflow, including adding the following to the php.ini file:

我已经尝试了我在 StackOverflow 上阅读的所有内容，包括将以下内容添加到 php.ini 文件中：

curl.cainfo = "C:\xampp\php\cacert.pem"

And ofcourse downloaded to that location the cacert.pem file from http://curl.haxx.se/docs/caextract.html

当然，从http://curl.haxx.se/docs/caextract.html下载 cacert.pem 文件到那个位置

but after all that, restarted XAMPP and Apache server but still getting the same error.

但毕竟，重新启动了 XAMPP 和 Apache 服务器，但仍然出现相同的错误。

I really don't know what else to try.

我真的不知道还能尝试什么。

Can anyone advise on what else can I try?

谁能建议我还能尝试什么？

回答by Mladen Janjetovic

Finally got this to work!

终于让这个工作了！

1. Download the certificate bundle.

2. Put it somewhere. In my case, that was c:\wamp\directory (if you are using Wamp 64 bit then it's c:\wamp64\).

3. Enable mod_sslin Apache and php_openssl.dllin php.ini(uncomment them by removing ;at the beginning). But be careful, my problem was that I had two php.inifiles and I need to do this in both of them. One is the one you get from your WAMP taskbar icon, and another one is, in my case, in C:\wamp\bin\php\php5.5.12\

4. Add these lines to your cert in both php.inifiles:

   curl.cainfo="C:/wamp/cacert.pem"
   openssl.cafile="C:/wamp/cacert.pem"
   

5. Restart Wamp services.

1. 下载证书包。

2. 把它放在某个地方。就我而言，那是c:\wamp\目录（如果您使用的是 Wamp 64 位，则是c:\wamp64\）。

3. mod_ssl在 Apache 和php_openssl.dllin 中启用php.ini（通过;在开头删除来取​​消注释）。但要小心，我的问题是我有两个php.ini文件，我需要在这两个文件中都这样做。一个是您从 WAMP 任务栏图标中获得的一个，另一个是，就我而言，在C:\wamp\bin\php\php5.5.12\

4. 将这些行添加到您的两个php.ini文件中的证书中：

   curl.cainfo="C:/wamp/cacert.pem"
   openssl.cafile="C:/wamp/cacert.pem"
   

5. 重新启动 Wamp 服务。

回答by Shehzad Nizamani

Disclaimer: This code makes your server insecure.

免责声明：此代码使您的服务器不安全。

I had the same problem in Mandrill.php file after line number 65 where it says $this->ch = curl_init();

我在 Mandrill.php 文件中第 65 行之后遇到了同样的问题，它说 $this->ch = curl_init();

Add following two lines:

添加以下两行：

curl_setopt($this->ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($this->ch, CURLOPT_SSL_VERIFYPEER, 0);

This solved my problem and also sent email using localhost but I suggest to NOT use it on live version live. On your live server the code should work without this code.

这解决了我的问题，并使用 localhost 发送了电子邮件，但我建议不要在实时版本上使用它。在您的实时服务器上，代码应该可以在没有此代码的情况下工作。

回答by Damodar Bashyal

Thanks @Mladen Janjetovic,

谢谢@Mladen Janjetovic，

Your suggestion worked for me in mac with ampps installed.

您的建议在安装了 ampps 的 mac 中对我有用。

Copied:http://curl.haxx.se/ca/cacert.pem

复制：http : //curl.haxx.se/ca/cacert.pem

To:/Applications/AMPPS/extra/etc/openssl/certs/cacert.pem

到：/Applications/AMPPS/extra/etc/openssl/certs/cacert.pem

And updated php.iniwith that path and restarted Apache:

并php.ini使用该路径进行更新并重新启动 Apache：

[curl]
; A default value for the CURLOPT_CAINFO option. This is required to be an
; absolute path.
curl.cainfo="/Applications/AMPPS/extra/etc/openssl/certs/cacert.pem"
openssl.cafile="/Applications/AMPPS/extra/etc/openssl/certs/cacert.pem"

And applied same setting in windows AMPPS installation and it worked perfectly in it too.

并在 Windows AMPPS 安装中应用相同的设置，它也能完美运行。

[curl]
; A default value for the CURLOPT_CAINFO option. This is required to be an
; absolute path.
curl.cainfo="C:/Ampps/php/extras/ssl/cacert.pem"
openssl.cafile="C:/Ampps/php/extras/ssl/cacert.pem"

: Same for wamp.

: 和 wamp 一样。

[curl]
; A default value for the CURLOPT_CAINFO option. This is required to be an
; absolute path.
curl.cainfo="C:/wamp/bin/php/php5.6.16/extras/ssl/cacert.pem"
openssl.cafile="C:/wamp/bin/php/php5.6.16/extras/ssl/cacert.pem"

If you are looking for generating new SSL certificate using SAN for localhost, steps on this postworked for me on Centos 7 / Vagrant / Chrome Browser.

如果您正在寻找使用 SAN 为本地主机生成新 SSL 证书，这篇文章中的步骤对我有用Centos 7 / Vagrant / Chrome Browser。

回答by Arturo Alvarado

When you view the http://curl.haxx.se/docs/caextract.htmlpage, you will notice in big letters a section called:

当您查看http://curl.haxx.se/docs/caextract.html页面时，您会注意到一个大写的部分，称为：

RSA-1024 removed

RSA-1024 已删除

Read it, then download the version of the certificates that includes the 'RSA-1024' certificates. https://github.com/bagder/ca-bundle/blob/e9175fec5d0c4d42de24ed6d84a06d504d5e5a09/ca-bundle.crt

阅读它，然后下载包含“RSA-1024”证书的证书版本。 https://github.com/bagder/ca-bundle/blob/e9175fec5d0c4d42de24ed6d84a06d504d5e5a09/ca-bundle.crt

Those will work with Mandrill.

这些将与 Mandrill 一起使用。

Disabling SSL is a bad idea.

禁用 SSL 是一个坏主意。

回答by HopeKing

The above steps, though helpful, didnt work for me on Windows 8. I don't know the co-relation, but the below steps worked. Basically a change in the cacert.pem file. Hope this helps someone.

上述步骤虽然有帮助，但在 Windows 8 上对我不起作用。我不知道相互关系，但以下步骤有效。基本上是 cacert.pem 文件中的更改。希望这可以帮助某人。

• Download cacert.pem file from here: http://curl.haxx.se/docs/caextract.html
• Save the file in your PHP installation folder. (eg: If using xampp – save it in c:\Installation_Dir\xampp\php\cacert.pem).
• Open your php.ini file and add these lines:
• curl.cainfo=”C:\Installation_Dir\xampp\php\cacert.pem” openssl.cafile=”C:\Installation_Dir\xampp\php\cacert.pem”
• Restart your Apache server and that should fix it (Simply stop and start the services as needed).

• 从这里下载 cacert.pem 文件：http://curl.haxx.se/docs/caextract.html
• 将文件保存在 PHP 安装文件夹中。（例如：如果使用 xampp – 将其保存在 c:\Installation_Dir\xampp\php\cacert.pem 中）。
• 打开您的 php.ini 文件并添加以下行：
• curl.cainfo=”C:\Installation_Dir\xampp\php\cacert.pem” openssl.cafile=”C:\Installation_Dir\xampp\php\cacert.pem”
• 重新启动您的 Apache 服务器，应该会修复它（只需根据需要停止并启动服务）。

回答by Manish sharma

I found new Solution without any required certification to call curl only add two line code.

我发现新的解决方案无需任何认证即可调用 curl 只添加两行代码。

curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

回答by ban-geoengineering

If you don't have access to php.ini, adding this code (after your $ch = curl_init();line) works for me:

如果您无权访问php.ini，添加此代码（在您的$ch = curl_init();行之后）对我有用：

$certificate_location = "C:\Program Files (x86)\EasyPHP-Devserver-16.1\ca-bundle.crt"; // modify this line accordingly (may need to be absolute)
curl_setopt($ch, CURLOPT_CAINFO, $certificate_location);
curl_setopt($ch, CURLOPT_CAPATH, $certificate_location);

Then, you will just need to download ca-bundle.crtand save it to location you specified in $certificate_location.

然后，您只需要下载ca-bundle.crt并将其保存到您在$certificate_location.

回答by pankaj

I have Very Simple Solution of this problem. You can do this without any certificate file..

我有这个问题的非常简单的解决方案。您可以在没有任何证书文件的情况下执行此操作。

Go on Laravel Root Folder -> Vender -> guzzlehttp -> guzzle -> src

继续Laravel 根文件夹 -> Vender -> guzzlehttp -> guzzle -> src

open Client.php

打开Client.php

find $defaults Array . that look like this way ..

找到 $defaults 数组。看起来像这样..

$defaults = [
    'allow_redirects' => RedirectMiddleware::$defaultSettings,
    'http_errors'     => true,
    'decode_content'  => true,
    'verify'          => true,
    'cookies'         => false
];

Now main Job is to change value of verifykey ..

现在主要工作是更改验证密钥的值..

'verify'          => false,

So After this it will not check SSL Certificate for CURL Request... This Solution is work for me. I find this solution after many research ...

所以在这之后它不会检查 CURL 请求的 SSL 证书......这个解决方案对我有用。经过多次研究，我找到了这个解决方案......

回答by Yuan Libres

I tried this it works

我试过这个它有效

open

打开

vendor\guzzlehttp\guzzle\src\Handler\CurlFactory.php

and change this

并改变这一点

 $conf[CURLOPT_SSL_VERIFYHOST] = 2;
 `enter code here`$conf[CURLOPT_SSL_VERIFYPEER] = true;

to this

对此

$conf[CURLOPT_SSL_VERIFYHOST] = 0;
$conf[CURLOPT_SSL_VERIFYPEER] = FALSE;

回答by Noel

elaborating on the above answers for server deployment.

详细说明上述服务器部署的答案。

$hostname = gethostname();
if($hostname=="mydevpc")
{
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
}

should do the trick for development environment without compromising the server when deployed.

应该在部署时不影响服务器的情况下为开发环境提供技巧。