PHP cURL error 60: SSL Certificate Problem in CI

By Daniel Zoghalchali·Latchkey

cURL verifies a server certificate against a CA bundle. When PHP has no curl.cainfo/openssl.cafile configured, or the bundle is missing/stale on the runner, HTTPS requests fail with cURL error 60 - "unable to get local issuer certificate".

What this error means

An HTTPS request (Guzzle, a webhook call, a package fetch) fails in CI with "cURL error 60: SSL certificate problem: unable to get local issuer certificate". The same call works locally where a CA bundle is configured.

php

GuzzleHttp\Exception\RequestException: cURL error 60: SSL certificate problem:
unable to get local issuer certificate (see https://curl.se/libcurl/c/...)
for https://api.example.com/v1/ping

Diagnose it: version, extensions, and limits

Terminal

php -v
php -m
php -i | grep -E "memory_limit|max_execution_time|error_reporting"

# a runner default is often far tighter than your local php.ini
php -d memory_limit=-1 vendor/bin/<tool>

Common causes

No CA bundle configured for PHP/cURL

A minimal PHP image may not set curl.cainfo/openssl.cafile, so cURL cannot find trusted root certificates to verify the peer.

The CA bundle is missing or out of date

The ca-certificates package is absent or stale on the runner, so even configured paths point at no usable bundle.

How to fix it

Install and point PHP at a CA bundle

Install the certificates package and set the ini paths to the bundle.

php

apt-get update && apt-get install -y ca-certificates
php -d curl.cainfo=/etc/ssl/certs/ca-certificates.crt \
    -d openssl.cafile=/etc/ssl/certs/ca-certificates.crt bin/run.php

Set the paths in php.ini for the runner

php

; php.ini
curl.cainfo = /etc/ssl/certs/ca-certificates.crt
openssl.cafile = /etc/ssl/certs/ca-certificates.crt

Verify, and never just disable verification

Confirm the bundle file exists and is non-empty on the runner.
Test with curl -v https://api.example.com to see the verification result.
Do not set CURLOPT_SSL_VERIFYPEER=false to "fix" it - that disables security, not the bug.

How to prevent it

Install ca-certificates and configure curl.cainfo/openssl.cafile in the runner image.
Keep the CA bundle current as part of base image maintenance.
Never disable peer verification to silence cURL error 60.

Frequently asked questions

What causes PHP cURL error 60: SSL certificate problem in CI?

There are 2 common causes: no ca bundle configured for php/curl and the ca bundle is missing or out of date. A minimal PHP image may not set curl.cainfo/openssl.cafile, so cURL cannot find trusted root certificates to verify the peer.

How do I fix PHP cURL error 60: SSL certificate problem in CI?

There are 3 fixes depending on which cause you have: install and point php at a ca bundle, set the paths in php.ini for the runner, and verify, and never just disable verification. Work through them in order, since the first is the most common.

What does PHP cURL error 60: SSL certificate problem in CI actually mean?

An HTTPS request (Guzzle, a webhook call, a package fetch) fails in CI with "cURL error 60: SSL certificate problem: unable to get local issuer certificate".

How do I stop PHP cURL error 60: SSL certificate problem in CI happening again?

Install ca-certificates and configure curl.cainfo/openssl.cafile in the runner image. The prevention section lists 3 changes that keep it from recurring.