cURL error 60: SSL certificate problem: unable to get local issuer certificate
ID: php/curl-ssl-error
Version Compatibility
| Version | Status | Introduced | Deprecated | Notes |
|---|---|---|---|---|
| 83 | active | — | — | — |
Root Cause
cURL SSL certificate errors in PHP occur when the system's CA certificate bundle is missing, outdated, or not configured correctly. This prevents PHP from verifying the SSL certificate of the remote server. Common on fresh installations, Docker containers, and systems with custom CA certificates.
genericWorkarounds
-
91% success Install or update the CA certificate bundle on the system
Install the CA certificates package: 'apt-get install ca-certificates' and run 'update-ca-certificates'. For Docker containers, add this to the Dockerfile. Verify with 'php -r "var_dump(openssl_get_cert_locations());"' to see where PHP looks for certificates.
-
87% success Configure php.ini to point to the correct CA bundle path
Download the latest CA bundle from https://curl.se/ca/cacert.pem. Set in php.ini: 'curl.cainfo = /etc/ssl/certs/ca-certificates.crt' and 'openssl.cafile = /etc/ssl/certs/ca-certificates.crt'. Restart PHP-FPM. For custom internal CAs, append your CA cert to the bundle file.
Dead Ends
Common approaches that don't work:
-
Setting CURLOPT_SSL_VERIFYPEER to false to skip certificate verification
88% fail
Disabling SSL verification makes the connection vulnerable to man-in-the-middle attacks. An attacker can intercept and modify traffic between the application and the remote server. This is especially dangerous when transmitting credentials, payment data, or personal information.
-
Setting verify_peer to false in PHP stream context globally
90% fail
Disabling peer verification globally affects all HTTPS connections made by the PHP process, not just the problematic one. Every outbound HTTP request loses its security guarantee, creating a systemic vulnerability across the entire application.