PHP cURL caPath : none

[pcgrejaldo]

Hi!

I've been trying to figure out how to make PHP (7.4.18) cURL work with SSL and I've tried various php.ini settings but I'm stumped. Running curl on cli runs fine like: /home/linuxbrew/.linuxbrew/bin/curl -IL https://wp.test with response:

HTTP/2 200
server: nginx/1.18.0
date: Sat, 01 May 2021 16:00:58 GMT
content-type: text/html; charset=UTF-8
link: <https://wp.test/wp-json/>; rel="https://api.w.org/"
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

So looks good. However, when I try to use php-curl, with

curl_setopt( $handle, CURLOPT_VERBOSE, true );

I'm getting the following error:

*   Trying 127.0.0.1:443...
* Connected to newsfh.test (127.0.0.1) port 443 (#0)
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*  CAfile: /home/paul/sites/newsfh.test/wp-includes/certificates/ca-bundle.crt
*  CApath: none
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0

CApath seems to be not picking up the system's SSL certs dir when using homebrew's php but when I add the curl option:

curl_setopt( $handle, CURLOPT_CAPATH, '/etc/ssl/certs' );

then it works:

*   Trying 127.0.0.1:443...
* Connected to newsfh.test (127.0.0.1) port 443 (#0)
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*  CAfile: /home/paul/sites/newsfh.test/wp-includes/certificates/ca-bundle.crt
*  CApath: /etc/ssl/certs
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: O=mkcert development certificate; OU=paul@paul-msi-2018
*  start date: May  1 01:54:43 2021 GMT
*  expire date: Aug  1 01:54:43 2023 GMT
*  subjectAltName: host "newsfh.test" matched cert's "newsfh.test"
*  issuer: O=mkcert development CA; OU=paul@paul-msi-2018; CN=mkcert paul@paul-msi-2018
*  SSL certificate verify ok.
> GET /wp-json/wp/v2/categories?page=1&per_page=100 HTTP/1.1
Host: newsfh.test
User-Agent: WordPress/5.7.1; https://newsfh.test
Accept: */*
Accept-Encoding: deflate, gzip, br, zstd
Referer: https://newsfh.test/wp-json/wp/v2/categories?page=1&per_page=100
Connection: close

* old SSL session ID is stale, removing
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Server: nginx/1.18.0
< Date: Sat, 01 May 2021 16:08:29 GMT
< Content-Type: application/json; charset=UTF-8
< Transfer-Encoding: chunked
< Connection: close
< X-Robots-Tag: noindex
< Link: <https://newsfh.test/wp-json/>; rel="https://api.w.org/"
< X-Content-Type-Options: nosniff
< Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages, Link
< Access-Control-Allow-Headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
< Expires: Wed, 11 Jan 1984 05:00:00 GMT
< Cache-Control: no-cache, must-revalidate, max-age=0
< X-WP-Total: 82
< X-WP-TotalPages: 1
< Allow: GET, POST
< X-Frame-Options: SAMEORIGIN
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< 
* Closing connection 0

Current openssl cert locations:

Array
(
    [default_cert_file] => /home/linuxbrew/.linuxbrew/etc/[email protected]/cert.pem
    [default_cert_file_env] => SSL_CERT_FILE
    [default_cert_dir] => /home/linuxbrew/.linuxbrew/etc/[email protected]/certs
    [default_cert_dir_env] => SSL_CERT_DIR
    [default_private_dir] => /home/linuxbrew/.linuxbrew/etc/[email protected]/private
    [default_default_cert_area] => /home/linuxbrew/.linuxbrew/etc/[email protected]
    [ini_cafile] => /home/linuxbrew/.linuxbrew/etc/[email protected]/cert.pem
    [ini_capath] => /etc/ssl/certs
)

Already tried changing some php.ini config related to curl and openssl like changing curl.cainfo to

curl.cainfo = "/etc/ssl/certs"

...and commenting out:

openssl.cafile
openssl.capath

...but all no dice.

So question, how do I set CApath globally for Homebrew PHP without setting curl_setopt( $handle, CURLOPT_CAPATH, '/etc/ssl/certs' ); to all curl calls? Or any other suggestions?

Thanks!

[harryqt]

any fix?