reading SSL page with CURL (php)

Question

Hi,

I am trying to download the content of a secure (uses https) webpage using php and curl libraries.

However, reading failed and I get error 60: "SSL certificate problem, verify that the CA cert is OK."

also "Details: SSL3_GET_SERVER_CERTIFICATE:certificate verify failed"

So...pretty self explanatory error msg's.

My question is: How do I send an SSL certificate (the right one?) and get this page to verify it and let me in?

Also, here is my options array in case you are wondering:

    $options = array(
        CURLOPT_RETURNTRANSFER => true,     // return web page
        CURLOPT_HEADER         => false,    // don't return headers
        CURLOPT_FOLLOWLOCATION => true,     // follow redirects
        CURLOPT_ENCODING       => "",       // handle all encodings
        CURLOPT_USERAGENT      => "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:x.x.x) Gecko/20041107 Firefox/x.x", // who am i
        CURLOPT_AUTOREFERER    => true,     // set referer on redirect
        CURLOPT_CONNECTTIMEOUT => 120,      // timeout on connect
        CURLOPT_TIMEOUT        => 120,      // timeout on response
        CURLOPT_MAXREDIRS      => 10,       // stop after 10 redirects
        CURLOPT_SSL_VERIFYHOST => 1,
    );

Any suggestions would be great, Andrew

Answer 1

Think this article is what you need.

Answer 2

It sounds like you might be misinterpreting the error. It looks to me like the site you're connecting to is self-signed or some other common problem. Just like the usual browser warning, you're easiest work around is to disable the checks.

You'll need to set CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST to FALSE. This should disable the two main checks. They may not both be required, but this should at least get you going.

More info on the PHP site: curl_setopt()

Answer 3

You're not SENDing the SSL cert. It appears there's a problem with the SSL cert as it is installed on the host you are contacting. Use option -k or --insecure, to get past the complaint.

Ah. See Ryan Graham's answer

Answer 4

This is a "problem" with openssl and VeriSign.

I had a similar problem and my openssl was missing the intermediate ssl certificate used by VeriSign to sign the server certificate.

https://knowledge.verisign.com/support/ssl-certificates-support/index?page=content&id=AR657

I had to import these intermediate certificates from the VeriSign Homepage or Firefox cert-database-export into my local ca-certificates list and after this step I was able to use wget/curl to use the protected connection without any errors.