curl: (60) SSL certificate problem: unable to get local issuer certificate

abdelrahman

I was testing a site in uptime.com and i'm getting this error can't run the test, however it can be done on
https://pagespeed.web.dev/ and
https://tools.pingdom.com/
and the site itself when opened from incognito have no problem with the SSL

I followed some tutorials from YT and stackoverflow but not working
opened the terminal and typed php -i
got the location of loaded configuration file "it's not in my website but in the server" /www/server/php/74/etc
under this address i uploaded cacert.pem
then changed the php.ini curl.cainfo didn't work so i changed both php.ini and php-cli.ini

This was the default
curl.cainfo = /etc/pki/tls/certs/ca-bundle.crt

then i made like this
curl.cainfo = "/www/server/php/74/etc/cacert.pem"

didn't work so i did it like this "doesn't seem right to me, but i'm following tutorials blindly without understanding what is this actually"
curl.cainfo="/path/to/downloaded/cacert.pem"

klaus

curl.cainfo="/path/to/downloaded/cacert.pem"

This will say to php curl extension which certificate curl should use.

Did you restart PHP after edit it?

Which OS you use?

abdelrahman

klaus i restert the server, if not important and all i need to do is restart php then i don't know how to do it

OS suppose to be linux 8 for clarification in the aapanel under system Red Hat Enterprise 8.7 (Ootpa) aarch64(Py3.7.8)

klaus

abdelrahman App Store/PHP Version that you have installed press on settings and you have restart option, press it and try again.

abdelrahman

klaus sorry for confusion i restart the server not the aapanel, actually i don't have PHP "i do have it of course" but i installed WordPress and all the operations are done from there, however i've putty connection for the website and this is how i accessed the terminal to resolve the problem as you explained to me how to change the root to www

klaus

abdelrahman You can try to update curl because i think you have a old version of it.

sudo yum update curl

Run that one and test it again if doesn't work let me know.

abdelrahman

klaus
Last metadata expiration check: 0:25:59 ago on Fri 14 Apr 2023 01:25:55 PM GMT.
Dependencies resolved.
Nothing to do.
Complete!

klaus

abdelrahman Okay.

I will need more information about website to test out to see.

abdelrahman

klaus what information would be valuable to you?

general info, hosting on oracle cloud using the always free hosting option
sat the aapanel with putty & installed WordPress
from the app store installed firewall SYS Firewall 2.7
enabled the ssl for the aapanel with let's encrypt

everything else was done with WordPress interface which are plugins and add drop stuff, the website is encrypted with the ssl from any device incognito mode secure ssl the 60 ssl problem just appeared when i was testing the speed but i want to resolve it

klaus

I will need the website link to make a curl request.

You can do that on your own if you use windows open CMD if you use linux use Terminal

curl https://yourwebsite.com

and see if you get the same ssl error.

abdelrahman

i can't see the same error actually, but if you will investigate it more i'd be more than thankful https://abdelrahman.shop

klaus

You have a Let's Encrypt certificate that is not working on all browsers and some versions of curl detect it as invalid.

You should use the CloudFlare they offer now the google ssl and that is better than Let's Encrypt certificate.

P.S. You can remove that line from your php.ini, that was a uptime.com error because they don't accept Let's Encrypt Certificate.

abdelrahman

klaus I cancelled the let's encrypt certificate but this just disable it in the aapanel not in the website itself

EDIT
I did it and run the uptime test, its working, however, I feel my setup making the site taking too long to respond, it was faster before the cloudflare, which doesn't make sense since the primary reason for cloudflare is making it faster

klaus

abdelrahman If you use it only for DNS will not be faster, is not a load balancer.

https://www.hostinger.com/tutorials/how-to-setup-cloudflare-for-wordpress#5_Configure_the_HTTPS_Settings

There are many ways to make cloudflare faster.

aaP_ibtisam.devrims

Make sure the path to the cacert.pem file is accurate and accessible by your server. It should look something like curl.cainfo = "/www/server/php/74/etc/cacert.pem". If you have multiple PHP versions installed, confirm you're editing the correct php.ini file for the PHP version your site is using.