cURL SSL certificate problem after a PHP upgrade

Before you start

Save the complete error message and its timestamp in a private note. Record which page or action triggers it and what changed immediately beforehand. A screenshot of a blank page gives a developer less to work with than the first relevant log entry.

Do not post passwords, customer information or complete server paths in a public support thread.

Back up both files and the database before changing anything. Check how you would restore that backupA backup is a separate copy of your website's files and database, so you can bring the site back after a mistake, a hack or a failed update. too. Prefer a restricted test copy using the same PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing..

Disable real payments and outgoing customer emails on that copy. Change one thing per attempt and keep a note of it, so you can reverse an unsuccessful change without guessing what the previous setting was.

What is being checked

For a protected connection, the software checks the remote party's certificate. It needs information about trusted certificate authorities to do that. A new PHP environment may use different configuration or libraries.

The remote server may also have a problem. The fact that the error followed your upgrade does not establish which side is responsible.

PHP has settings for cURLcURL is a tool that lets software, such as PHP, fetch information from other websites and services, for example to check for updates or send an order. and for connections using SSL streams. The cURL setting curl.cainfo points to a trusted certificate file and requires an absolute path. SSL contexts have options including cafile and capath.

These are different configuration paths. Identify which one the affected integration uses before making adjustments.

Five steps to a repair

1. Record the error text, timestamp and failing integration. Remove secret URL parameters before sharing details. Does it fetch updates, contact a payment provider or import data? Test payments only through the designated test environment rather than repeatedly attempting real transactions.
2. Ask the host to confirm the PHP version and loaded configuration for the affected process. Check that the required extension is available and where it reads trusted certificates. A successful connection from your laptop does not establish that the server uses the same settings.
3. Have the configured certificate file and access to it checked. The administrator should use an appropriate maintained trust source. Do not download an arbitrary certificate bundle from a forum. A missing file, incorrect path and unreadable file call for different specific corrections.
4. Have the destination certificate checked too, including hostname, validity and chain. Use the exact hostname from the failed connection. If only one external service fails, give its supplier the findings. Do not change every PHP setting to hide a problem at the other end.
5. After the targeted correction, test again from the same server environment. Verify that the intended task finishes and certificate verification stays enabled. Record which setting or certificate chain changed and which test confirmed the result. Inspect fresh logs for further messages.

Not every cURL error concerns certificates

A timeout, an unresolved hostname and an unavailable function need different investigations. If the message is Call to undefined function curl_init, begin with the function or extension. Use the related guide for that case.

This article concerns an attempted connection whose certificate verification does not succeed.

When to get help

Use the help form below if the connection handles payments or customer data, or you cannot manage certificate files. Provide a sanitized message and identify the affected environment. Ask the administrator to demonstrate a working connection with verification enabled.

A successful request after disabling verification is not an acceptable acceptance test. Keep that requirement explicit when handing the issue to another person.

Check the result

Repeat the exact action that failed first. Then check login, a form submission and the main journey through your website. For a store, use a test order without a real charge.

Read the log for fresh messages with a recent timestamp. A working homepage alone does not establish that every affected function works again.

Keep the version numbers, the change and the outcome with your maintenance notes. Agree who will check the next update. Stop if the same error returns after the suspected cause has already been addressed.

Revisit the diagnosis instead of changing an increasing number of settings together. The aim is a repeatable repair that someone else can understand and verify.