PHP, SSL, and cURL SSL3_GET_SERVER_CERTIFICATE Errors

I recently developed a complex system for a customer that involved PHP, cURL, and a SSL connection to a third party vendor. The third party vendor would validate the security certificate of the source (the system I created) and either allow or reject access. My code looked like this:

$ch = curl_init();

curl_setopt($ch,CURLOPT_URL,'https://thirdparty.com/token.php'); //not the actual site

curl_setopt($ch,CURLOPT_TIMEOUT,60);

curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);

curl_setopt($ch,CURLOPT_POST,1);

curl_setopt($ch,CURLOPT_POSTFIELDS,'customer_id='.$cid.'&password='.$pass);

curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,true); 

curl_setopt($ch,CURLOPT_CAINFO,'ca-bundle.crt'); /* problem here! */

$result = curl_exec($ch);

if(empty($result)) { /* error: nothing returned */ } else { /* success! */ }

curl_close($ch);

Unfortunately I was persistently receiving the following error message:

error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

It turns out that the SSL bundle file I was using was old, as was the default bundle that came with the old version of cURL the shared hosting server. Essentially the third party didn’t trust that the system’s SSL certificate was valid. I downloaded Mozilla’s bundle file, named itmozilla.pem and changed my PHP code to:

$ch = curl_init();

curl_setopt($ch,CURLOPT_URL,'https://thirdparty.com/token.php'); //not the actual site

curl_setopt($ch,CURLOPT_TIMEOUT,60);

curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);

curl_setopt($ch,CURLOPT_POST,1);

curl_setopt($ch,CURLOPT_POSTFIELDS,'customer_id='.$cid.'&password='.$pass);

curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,true); 

curl_setopt($ch,CURLOPT_CAINFO,'mozilla.pem'); /* fixed! */

$result = curl_exec($ch);

if(empty($result)) { /* error: nothing returned */ } else { /* success! */ }

curl_close($ch);

I share this with you because it cost me over three hours. Hopefully this will save someone time and frustration in the future.