With translate5 3.1.1 PHP must be installed with curl. Curl is needed to talk to several third party services, mainly openID connect, or also the language resource "google machine translation".
The communication is done encrypted with SSL therefore curl needs up to date ca.cert informations on the local machine. The CAs of the SSL certificate of the requested URLs are checked against this local CA list.
If the local CA list is not update or if the requested server does not provide all intermediate certificates, the following or similar errors can occur:
cURL error 60: SSL certificate problem: unable to get local issuer certificate
Investigate the problem
Either use an online tool like https://globalsign.ssllabs.com/ or a local openssl to track down the problem:
If openssl shows only one certificate with a error like that:
Verify return code: 21 (unable to verify the first certificate)
This indicates that the requested server only provides the server certificate but no intermediate certificate.
The problem about missing intermediates is, that browser solve that problem automatically by either fetching the missing intermediates or check an internal cache containing already the missing intermediate certificates.
Curl does not have such a cache / fetch mechanism.
Therefore a good server always provides the server cert and its cert chain / intermediate certs.
Solution if CA chain provided by the server is not complete
Contact the server administrator so that the missing intermediate certificates / the certificate chain is delivered too. For example in apache this must be done in configuration like that:
Provide missing chain as intermediate solution
Open the HTTPS URL in firefox, click on the lock symbol beneath the URL.
Click on more information.
Then a new window opens in firefox, press on show certificate.
In a new tab more information about the certificate is shown. Each certificate in the chain gets an own tab in that window. In the first Tab - the server certificate - click on "Save PME (Certificatechain)"
Save that file for later reuse with CURL.
In PHP curl the chain file must be provided with the following curl option:
curl_setopt($ch, CURLOPT_CAINFO, "/path/to/downloadedchainfile.pem");
The server must provide valid certificate data, so consider above CAINFO setting only as temporary workaround!
Solution if local CA is completely not update
In this case either update the CA bundle of the operating system (updating ca-certificates package) , or download up-to-date CA bundle on your own, and configure curl to use it.
To use the downloaded file, use it at an suitable place on the disk and configure it in the used php.ini:
The cacert.pem can be downloaded from http://curl.haxx.se/ca/cacert.pem
- Explanation that browsers do fetching and caching of missing intermediates, curl does not do that.
Also explanation how to check all single certificates:
- Pointing into the direction of missing intermediate certificates:
- Example of a PHP CURL request:
- Brief explanations why
CURLOPT_SSL_VERIFYPEERis very dangerous: