title: How do I keep my cacert.pem current for security reasons when using curl?
body: <p>I would like to keep my root certificates current for use with cURL and PHP's internal <code>curl</code> command, however there is no parameter currently to download the current file it requires for a proper secure connection and to keep it current.</p>
  
  <p>And example of using <code>curl</code> in PHP for a secure connection which requires a file named <code>cacert.pem</code> (PEM encoded certificate chain for validating remote connections) is as follows :</p>
  
  <pre><code>$ch = curl_init();
  curl_setopt($ch, CURLOPT_URL, "https://www.google.com");
  curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 15);
  curl_setopt($ch, CURLOPT_TIMEOUT, 15);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  curl_setopt($ch, CURLOPT_HEADER, 0);
  curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 1);
  curl_setopt($ch, CURLOPT_CAINFO, "pathto/cacert.pem");
  curl_setopt($ch, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
  if (!($data = curl_exec($ch))) {
      echo "No data received";
  } else {
      echo strlen($data) + " total byte(s)";
  }
  curl_close($ch);
  </code></pre>
  
  <p>While most people simply set <code>CURLOPT_SSL_VERIFYPEER</code> to false, and thus ignore the problem, <a href="https://stackoverflow.com/a/4661467/3504007">which is bad</a> .  You can <a href="https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&amp;id=SO6318&amp;actp=search&amp;viewlocale=en_US&amp;searchid=1432652547716" rel="nofollow noreferrer">see here where a certificate authority shows that if you do not have this file current, the only way to connect to a secure server is to disable certificate checking and further warns of the implications behind disabling peer verification</a>.</p>
  
  <p>What I am requesting is for a legitimate way to maintain a local copy of <code>cacert.pem</code> so that when I use <code>curl</code> in PHP to communicate with other servers, I can continue to do so <strong>securely</strong> .</p>
  
  <p>This is not a request for an external resource or off-site link etc, however due to the nature of the problem, it is likely that may be the ONLY way to resolve this as it would require continuous updating as certificate chains are revoked. To date, there is no way to obtain this file either as part of the distribution of curl itself, or php, or the curl library for php and continue to maintain it.  While it is discouraging that this is not something which a simple update command like <code>curl --update-root-ca</code> would be nice, it does not exist in any form.</p>