basic steps taken:
# echo -n | openssl s_client -showcerts -connect example.com:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /tmp/example.cert
# curl -v --cacert /tmp/example.cert https://example.com/
* About to connect() to example.com port 443 (#0)
* Trying 123.45.67.89... connected
* Connected to example.com (123.45.67.89) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: example.cert
CApath: none
* NSS error -12188
* Closing connection #0
* SSL connect error
curl: (35) SSL connect error
I tried pem with a certificate chain, and also as just the plain host certificate.
Sometimes I also get the error Problem with the SSL CA cert (path? access rights?)
.
also tried (as a temporary work around):
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, false);
# echo 'insecure' > $CURL_HOME/.curlrc
still I will end up with SSL connect error
.
Best Answer
don't use curl.
stream_context_create
works just as well.