Question

我正在尝试访问具有SSL认证的网址，并使用php curl使用https。卷曲选项设置如下。

$url = 'https://example.com';
$curl = curl_init();
curl_setopt_array($curl, [
    CURLOPT_URL => $url,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_SSL_VERIFYPEER => true,
    CURLOPT_SSL_VERIFYHOST => 2,
    CURLOPT_POST => true,
]);
$curlResponce = curl_exec($curl);
$curlError = curl_error($curl);
curl_close($curl);

上面的curl代码返回以下错误。

SSL证书问题：无法获取本地颁发者证书

但是，当我使用浏览器访问相同的URL时，它将正确显示网页，而SSL证书中没有任何问题。如果我使用相同的代码来访问https://www.google.com，则会显示Google页面，而不会出现任何错误。

网站“ https://example.com”托管在AWS中，并使用RapidSSL RSA CA 2018颁发的SSL证书。该证书未过期。

当我在命令行中使用openssl来测试“ https://example.com”之后，确认是否发生了错误。

Hasanta:~ hsumudupriya$ openssl s_client -connect example.com:443
CONNECTED(00000003)
depth=0 /CN=www.example.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /CN=www.example.com
verify error:num=27:certificate not trusted
verify return:1
depth=0 /CN=www.example.com
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:/CN=www.example.com
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=RapidSSL RSA CA 2018
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFwjCCBKqgAwIBAgIQAd3vbVFjNnIlyEHjmZChmzANBgkqhkiG9w0BAQsFADBe
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMR0wGwYDVQQDExRSYXBpZFNTTCBSU0EgQ0EgMjAxODAe
Fw0xOTAxMjEwMDAwMDBaFw0yMDAxMjExMjAwMDBaMB0xGzAZBgNVBAMTEnd3dy5w
ZXdlbGRiYW5rLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAO4z
N+NKUcPlq2awP7+DWPHuE8zoD339v3c8ge1dxHh4XtMsxhDrP03etDCjZjr04AKS
/eTFdFrpATX8zbhxrUj7w0mbXTWgS2ruxQgYeQGRCwvXHCyGcBREXzIsNRh39fZw
x+kAby+bUymAeQ3ixI2ChCNH9PU5IBZ9WiLHI9d5nW8SkhO7ThcsHItamOEqPIQ7
vbu9b/gYvx0FQ+u24gZYazpWDDxqtYhJzGMLT9WEA35oD94CsRUXdvPv7TjjsTb9
Y9qLy/7SDGMmP6S/PIa2Wp2TaIW5UvgBUEDmRMMzHOePREeyGTC8KtSHYxtbMJyd
RkA3PIVbEM28PLnuoCMCAwEAAaOCArswggK3MB8GA1UdIwQYMBaAFFPKF1n8a8AD
IS8aruSqqByCVtp1MB0GA1UdDgQWBBRx/2R+46KD96n1weCytLRP74jGgDAtBgNV
HREEJjAkghJ3d3cucGV3ZWxkYmFuay5jb22CDnBld2VsZGJhbmsuY29tMA4GA1Ud
DwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwPgYDVR0f
BDcwNTAzoDGgL4YtaHR0cDovL2NkcC5yYXBpZHNzbC5jb20vUmFwaWRTU0xSU0FD
QTIwMTguY3JsMEwGA1UdIARFMEMwNwYJYIZIAYb9bAECMCowKAYIKwYBBQUHAgEW
HGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwCAYGZ4EMAQIBMHUGCCsGAQUF
BwEBBGkwZzAmBggrBgEFBQcwAYYaaHR0cDovL3N0YXR1cy5yYXBpZHNzbC5jb20w
PQYIKwYBBQUHMAKGMWh0dHA6Ly9jYWNlcnRzLnJhcGlkc3NsLmNvbS9SYXBpZFNT
TFJTQUNBMjAxOC5jcnQwCQYDVR0TBAIwADCCAQUGCisGAQQB1nkCBAIEgfYEgfMA
8QB2ALIeBcyLos2KIE6HZvkruYolIGdr2vpw57JJUy3vi5BeAAABaG9eTHsAAAQD
AEcwRQIgKUDoVrCW5gkmC196ffInmfoV6t0vQ+Ue9EfZ+e+IidUCIQC03XtAQMzg
tDlW1n2MPbdVjqRtDpnOW9rVgJx9M1uOcgB3AId1v+dZfPiMQ5lfvfNu/1aNR1Y2
/0q1YMG06v9eoIMPAAABaG9eTTUAAAQDAEgwRgIhAL5YulISvgf3uwXwrFKhTomC
HJa+FUhDxNjDKGDRhcqSAiEAp+Mb4qu4Fejh9GgphGn02B2HqndO0KFJvDjSvyfj
yBkwDQYJKoZIhvcNAQELBQADggEBAMfnhpeKWKV36+TuS+aTuzynr9qKQdnPhL2s
gjEo+NHK48Z/RYiVLf6Ua5Sq4rn9RTGqi7aQaoCcXwb90j3t5NONOMnw3PexbLfH
xr6qR0Z9ybJsLi326AVNfSMmbuy+RGqbHiNi9+y15yce+ozw+LK0eN3ZDvnuQPP2
CrwevWZhCuAGQ2PQc5rPilIbe/sE0C9Nf7wu78g7zowMRHf4TOsP/VZE/xC1MlIn
I9mm652488zO4WH3c7WnssEbUDqoGnIZ4v/3V3nckriEI+EM1ZNtguGYSAMeUsny
Odh738FbIJ1muWvwj3xCOOjSgrzRZ0EA1HhhO230ek/Zc7KEbD0=
-----END CERTIFICATE-----
subject=/CN=www.example.com
issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=RapidSSL RSA CA 2018
---
No client certificate CA names sent
---
SSL handshake has read 2433 bytes and written 456 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 5C2759394B4EC8B2F37EEF89ACBC01B5EF6B6F76CA809C6C2823BAD01AE368D5
    Session-ID-ctx: 
    Master-Key: 6FE824F4F83B4205288D3DC23EE0FA0817A265FC818EDA37071A5DD21E088A74DD7DD19F69CB9A1A226BF43124CCD1FE
    Key-Arg   : None
    Start Time: 1555058725
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
---
read:errno=0

关于“ php curl-SSL证书问题：无法获取本地颁发者证书”的大多数答案都涉及在localhost / mamp中配置php curl设置并手动添加cacert.pem和ca-bundle.crt。但是就我而言，这不是我本地主机中的php curl的问题，因为我可以通过https访问其他站点。

Answer 1

当使用最新版本替换现有的Intermediate-CA证书文件时，此问题已解决。问题是现有的Intermediate-CA证书文件已经过时。

PHP cURL-SSL证书问题：无法获取本地颁发者证书

1 个答案: