Does Lumen provide a global configuration for SSL certificate verification in outbound requests?

Direct Answer

No. Lumen does not ship a built-in global configuration key that controls SSL certificate verification for every outbound HTTP request. The framework delegates outbound HTTP behavior to the underlying HTTP client—typically Guzzle via Laravel's HTTP client facade—and that client verifies TLS certificates against the system CA bundle by default.

Likely Explanation vs. Confirmed Facts

Because Lumen is a micro-framework, its configuration surface is intentionally minimal. There is no config/http.php or equivalent setting that automatically injects a verify option into all requests. The verify behavior is a property of the Guzzle handler stack, not the Lumen application container. Unless you explicitly wrap or bind a client, each request inherits Guzzle's default—verification enabled.

Recommended Pattern for Environment-Specific Defaults

To avoid repeating verify on every call, register a service provider that binds a configured HTTP client or defines a macro. The following example reads APP_ENV and applies strict verification outside local development:

<?php

namespace App\Providers;

use Illuminate\Support\Facades\Http;
use Illuminate\Support\ServiceProvider;

class HttpClientServiceProvider extends ServiceProvider
{
    public function boot()
    {
        Http::macro('secure', function () {
            $verify = env('APP_ENV') !== 'local';
            return $this->withOptions(['verify' => $verify]);
        });
    }
}

Use Http::secure()->get(...) throughout the application. If you need a fully injected client instead of a macro, bind a GuzzleHttp\Client instance in the container with a default verify option derived from configuration.

Caveats and Version Notes

• Third-party packages (e.g., AWS SDK, Stripe PHP) instantiate their own Guzzle clients and will not inherit your macro or container binding.
• Native PHP streams (file_get_contents, SoapClient) ignore Lumen HTTP client settings entirely.
• Lumen 10+ / Laravel 11+ introduced a config/http.php file for HTTP client defaults, but Lumen's default skeleton may not include it. You can create it manually if your installed components support it.
• Older Lumen versions (< 8.x) may not ship the Illuminate\Support\Facades\Http facade; you would configure raw Guzzle directly.

Verification Steps

1. Check composer.json for laravel/lumen-framework and guzzlehttp/guzzle versions.
2. Search the codebase for existing Http::withOptions, Http::macro, or container bindings for Illuminate\Http\Client.
3. Test against a local self-signed endpoint to confirm the default behavior before and after applying the macro.

Which Lumen version are you running, and do your outbound calls use the Http facade or raw Guzzle? That determines whether a macro, a container binding, or a manual config/http.php file is the right fit.