Troubleshooting Ignored CURLOPT_SSL_VERIFYPEER in PHP CURL

Problem:

Users are encountering an issue where HTTPS requests using CURL raise a "Problem with the SSL CA cert" error, despite setting both CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST to false.

Causes and Solutions:

To successfully verify host or peer certificates using CURL, you need to specify alternate certificates with CURLOPT_CAINFO or a certificate directory with CURLOPT_CAPATH.

Additionally:

• CURLOPT_SSL_VERIFYHOST:

  • Set to 1 to check common name existence in the SSL peer certificate.
  • Set to 2 to check common name existence and match it against the provided hostname.

Suggested Code:

To disable verification for host and peer:

curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);

To enable verification and specify a CA certificate file:

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 1);
curl_setopt($ch, CURLOPT_CAINFO, "/path/to/cacert.pem");

Additional Notes:

• Ensure that the CA certificate file is valid and accessible by the server.
• The curl.cainfo setting in php.ini can also be used to specify the CA certificate file.
• Rename /etc/pki/nssdb to /etc/pki/nssdb.old to reset certificate authorities.

Update:

After updating libraries and restarting the system, the issue may resolve itself.