cURL: problem with certificate

PercyDwn

A thirt party extension in my project uses GuzzleHttp to make requests to an api via curl. With XAMPP everything worked fine, but with Indigo I get following error:
cURL error 77: error setting certificate verify locations: CAfile: /ca-certificates/cert.pem CApath: none

I tried different solutions like creating a .curlrc file or a custom php.ini file with curl.cainfo set, but nothing worked so far. Any idea how this can be solved?

Deadpikle

I'm also experiencing this error. I'm guessing the missing crt file(s) need to be put somewhere based on these SO posts (https://stackoverflow.com/questions/30240840/laravel-5-socialite-curl-error-77-error-setting-certificate-verify-locations; https://stackoverflow.com/questions/55204210/curl-error-77-error-setting-certificate-verify-locations-cafile)

XAMPP sets this to: openssl.cafile=/Applications/XAMPP/xamppfiles/share/curl/curl-ca-bundle.crt

Deadpikle

A workaround:

In your custom php.ini (https://indigostack.app/docs/how-to/advanced-configuration/ for help on that), set:

openssl.cafile="/Users/YourUsernameHere/.indigo/ssl/curl-ca-bundle.crt"
openssl.capath = "/Users/YourUsernameHere/.indigo/ssl"

You'll need that curl-ca-bundle.crt file. I got it out of my macOS XAMPP 8 install in the share/curl directory and copied it to the above path.

I'm guessing there's a better way, but I'm not sure how else to redirect files appropriately to my .indigo folder or how to override the PHP install stuff to properly point to those certs... @Indigo, can you lend a hand here? 🙂 Thanks.

EDIT:

You can use openssl.cafile="{{service_path}}/ca-certificates/curl-ca-bundle.crt" and openssl.capath = "{{service_path}}/ca-certificates" instead. Then set up your PHP settings override folder structure like this (changing names for the php_8A71 folder as needed; the .pem file is not needed and was just me testing, FYI):

PercyDwn

Deadpikle
Thank you for the workaround! works like a charm 🙂

Indigo
Very nice you were able to find the cause so fast. Looking forward for the next release and using the workaround until then 🙂

Indigo

@PercyDwn and @Deadpikle — thanks for persevering against this issue. I'm disappointed it's raised its head again. I also need to use CURL with https (via Guzzle) and thus have previously hit this error in Indigo myself. I did fix it, but made some upgrades to Indigo's Curl in Feb this year and it seems a configuration was broken at that point.

The underlying issue is that Curl does not use the OS's trusted certificate authorities (as on Mac they are stored in the macOS Keychain, which is obviously different than how Linux distros handle their CA store).

I'll dig into this.

Indigo

OK, I am hoping I have found the cause of this error. Again, so sorry you encountered it; it's the kind of thing I really want to "just work" in Indigo — developer joy and all that 🙂

In my uncompiled PHP config (eg at Indigo.app/Contents/Resources/Services/php/8.2.0_3/etc/php.ini for the morbidly curious) you will see these:

openssl.cafile = "{{ssl_certificate_dir}}/ca-certificates/cert.pem"
openssl.capath = "{{ssl_certificate_dir}}/ca-certificates"

However, I've discovered that inside Indigo I wasn't supplying ssl_certificate_dir to the Mustache templating system for PHP services, meaning after compilation it became this:

openssl.cafile = "/ca-certificates/cert.pem"
openssl.capath = "/ca-certificates"

Then to compound issues my bundler wasn't including the ca-certificates directory either!

This will be fixed in the next release. In the meantime, @Deadpikle 's solution should indeed work — BTW a very clever use of the config override system 🙂

Indigo

Indigo 1.0.0-beta.10 has just been released which should resolve this issue.