SSL certificate problem: unable to get local issuer certificate in PHP OpenSSL

Question

PHP utilizes the OpenSSL extension to validate certificates during TLS handshakes for HTTPS requests. When the underlying library cannot locate a trusted root CA bundle, the system triggers a validation failure.

The php.ini configuration provides openssl.cafile and openssl.capath to define these trust stores. However, there is often a discrepancy between the default CA paths used by the operating system's OpenSSL installation and the paths recognized by the PHP runtime environment, particularly when deploying across different OS distributions.

Given these configuration requirements, what is the recommended method for ensuring consistent CA bundle resolution without hardcoding OS-specific paths? How does PHP prioritize the openssl.cafile directive relative to the system-level OpenSSL defaults?

Zoha · Answer

Resolution
To resolve the "unable to get local issuer certificate" error without hardcoding OS-specific paths, the recommended method is to bundle a trusted CA certificate file (such as cacert.pem) within your project or a known application directory and reference it via an absolute path in the php.ini configuration.

Implementation Steps

Obtain a Trusted Bundle: Download the current CA bundle from a trusted source, such as the curl project (curl.se/ca/cacert.pem).
Place the File: Move cacert.pem to a directory accessible by the PHP process (e.g., /etc/ssl/certs/php/ or a dedicated project config folder).
Configure php.ini: Set the openssl.cafile directive to the absolute path of the file:
openssl.cafile="/path/to/cacert.pem"

Restart Services: Restart your web server (Apache/Nginx) or PHP-FPM process to apply the changes.

Prioritization and Logic
PHP's OpenSSL extension follows a specific hierarchy when searching for root certificates to validate a TLS handshake. The prioritization generally functions as follows:

openssl.cafile: This directive takes the highest priority. If a valid path is provided here, PHP uses this specific file and ignores other sources.
openssl.capath: If cafile is not set, PHP looks for a directory containing multiple certificate files as specified in this directive.
System Defaults: If neither directive is configured in php.ini, the OpenSSL extension falls back to the default certificate store compiled into the system's OpenSSL library (which varies significantly between Windows, macOS, and Linux distributions).

Verification
To verify that the configuration is active, run the following command in your terminal:
php -i | grep openssl.cafile
If the output matches your configured path, the runtime is correctly pointing to the bundle. You can further verify by attempting a file_get_contents('https://google.com') call in a script; a lack of warnings indicates successful validation.

Diagnostic Note
Are you using the cURL extension for these requests? If so, you may also need to set curl.cainfo in php.ini, as cURL sometimes ignores the general OpenSSL settings depending on the PHP version and build.

SSL certificate problem: unable to get local issuer certificate in PHP OpenSSL

1 answer

Resolution

Implementation Steps

Prioritization and Logic

Verification

Diagnostic Note

Your perspective belongs here.

1 question comment

Runtime CA Override