title: PHP cURL - SSL certificate problem: unable to get local issuer certificate
body: <p>I'm trying to access an url which has SSL certification and use https using php curl. The curl options are set as follows.</p>
  
  <pre><code>$url = 'https://example.com';
  $curl = curl_init();
  curl_setopt_array($curl, [
      CURLOPT_URL =&gt; $url,
      CURLOPT_RETURNTRANSFER =&gt; true,
      CURLOPT_SSL_VERIFYPEER =&gt; true,
      CURLOPT_SSL_VERIFYHOST =&gt; 2,
      CURLOPT_POST =&gt; true,
  ]);
  $curlResponce = curl_exec($curl);
  $curlError = curl_error($curl);
  curl_close($curl);
  </code></pre>
  
  <p>The above curl code returns the following error.</p>
  
  <blockquote>
    <p>SSL certificate problem: unable to get local issuer certificate</p>
  </blockquote>
  
  <p>But when I visit the same url using a browser, it displays the web page correctly without any issue in the SSL certificate. If I use the same to code to access <a href="https://www.google.com" rel="nofollow noreferrer">https://www.google.com</a>, Google page is displayed without any errors.</p>
  
  <p>The web site "<a href="https://example.com" rel="nofollow noreferrer">https://example.com</a>" is hosted in AWS and uses a SSL certificate issued by RapidSSL RSA CA 2018. The certificate is not expired.</p>
  
  <p>When I use openssl in command line to test "<a href="https://example.com" rel="nofollow noreferrer">https://example.com</a>" following verify errors are occurred.</p>
  
  <pre><code>Hasanta:~ hsumudupriya$ openssl s_client -connect example.com:443
  CONNECTED(00000003)
  depth=0 /CN=www.example.com
  verify error:num=20:unable to get local issuer certificate
  verify return:1
  depth=0 /CN=www.example.com
  verify error:num=27:certificate not trusted
  verify return:1
  depth=0 /CN=www.example.com
  verify error:num=21:unable to verify the first certificate
  verify return:1
  ---
  Certificate chain
   0 s:/CN=www.example.com
     i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=RapidSSL RSA CA 2018
  ---
  Server certificate
  -----BEGIN CERTIFICATE-----
  MIIFwjCCBKqgAwIBAgIQAd3vbVFjNnIlyEHjmZChmzANBgkqhkiG9w0BAQsFADBe
  MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
  d3cuZGlnaWNlcnQuY29tMR0wGwYDVQQDExRSYXBpZFNTTCBSU0EgQ0EgMjAxODAe
  Fw0xOTAxMjEwMDAwMDBaFw0yMDAxMjExMjAwMDBaMB0xGzAZBgNVBAMTEnd3dy5w
  ZXdlbGRiYW5rLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAO4z
  N+NKUcPlq2awP7+DWPHuE8zoD339v3c8ge1dxHh4XtMsxhDrP03etDCjZjr04AKS
  /eTFdFrpATX8zbhxrUj7w0mbXTWgS2ruxQgYeQGRCwvXHCyGcBREXzIsNRh39fZw
  x+kAby+bUymAeQ3ixI2ChCNH9PU5IBZ9WiLHI9d5nW8SkhO7ThcsHItamOEqPIQ7
  vbu9b/gYvx0FQ+u24gZYazpWDDxqtYhJzGMLT9WEA35oD94CsRUXdvPv7TjjsTb9
  Y9qLy/7SDGMmP6S/PIa2Wp2TaIW5UvgBUEDmRMMzHOePREeyGTC8KtSHYxtbMJyd
  RkA3PIVbEM28PLnuoCMCAwEAAaOCArswggK3MB8GA1UdIwQYMBaAFFPKF1n8a8AD
  IS8aruSqqByCVtp1MB0GA1UdDgQWBBRx/2R+46KD96n1weCytLRP74jGgDAtBgNV
  HREEJjAkghJ3d3cucGV3ZWxkYmFuay5jb22CDnBld2VsZGJhbmsuY29tMA4GA1Ud
  DwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwPgYDVR0f
  BDcwNTAzoDGgL4YtaHR0cDovL2NkcC5yYXBpZHNzbC5jb20vUmFwaWRTU0xSU0FD
  QTIwMTguY3JsMEwGA1UdIARFMEMwNwYJYIZIAYb9bAECMCowKAYIKwYBBQUHAgEW
  HGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwCAYGZ4EMAQIBMHUGCCsGAQUF
  BwEBBGkwZzAmBggrBgEFBQcwAYYaaHR0cDovL3N0YXR1cy5yYXBpZHNzbC5jb20w
  PQYIKwYBBQUHMAKGMWh0dHA6Ly9jYWNlcnRzLnJhcGlkc3NsLmNvbS9SYXBpZFNT
  TFJTQUNBMjAxOC5jcnQwCQYDVR0TBAIwADCCAQUGCisGAQQB1nkCBAIEgfYEgfMA
  8QB2ALIeBcyLos2KIE6HZvkruYolIGdr2vpw57JJUy3vi5BeAAABaG9eTHsAAAQD
  AEcwRQIgKUDoVrCW5gkmC196ffInmfoV6t0vQ+Ue9EfZ+e+IidUCIQC03XtAQMzg
  tDlW1n2MPbdVjqRtDpnOW9rVgJx9M1uOcgB3AId1v+dZfPiMQ5lfvfNu/1aNR1Y2
  /0q1YMG06v9eoIMPAAABaG9eTTUAAAQDAEgwRgIhAL5YulISvgf3uwXwrFKhTomC
  HJa+FUhDxNjDKGDRhcqSAiEAp+Mb4qu4Fejh9GgphGn02B2HqndO0KFJvDjSvyfj
  yBkwDQYJKoZIhvcNAQELBQADggEBAMfnhpeKWKV36+TuS+aTuzynr9qKQdnPhL2s
  gjEo+NHK48Z/RYiVLf6Ua5Sq4rn9RTGqi7aQaoCcXwb90j3t5NONOMnw3PexbLfH
  xr6qR0Z9ybJsLi326AVNfSMmbuy+RGqbHiNi9+y15yce+ozw+LK0eN3ZDvnuQPP2
  CrwevWZhCuAGQ2PQc5rPilIbe/sE0C9Nf7wu78g7zowMRHf4TOsP/VZE/xC1MlIn
  I9mm652488zO4WH3c7WnssEbUDqoGnIZ4v/3V3nckriEI+EM1ZNtguGYSAMeUsny
  Odh738FbIJ1muWvwj3xCOOjSgrzRZ0EA1HhhO230ek/Zc7KEbD0=
  -----END CERTIFICATE-----
  subject=/CN=www.example.com
  issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=RapidSSL RSA CA 2018
  ---
  No client certificate CA names sent
  ---
  SSL handshake has read 2433 bytes and written 456 bytes
  ---
  New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
  Server public key is 2048 bit
  Secure Renegotiation IS supported
  Compression: NONE
  Expansion: NONE
  SSL-Session:
      Protocol  : TLSv1
      Cipher    : DHE-RSA-AES256-SHA
      Session-ID: 5C2759394B4EC8B2F37EEF89ACBC01B5EF6B6F76CA809C6C2823BAD01AE368D5
      Session-ID-ctx: 
      Master-Key: 6FE824F4F83B4205288D3DC23EE0FA0817A265FC818EDA37071A5DD21E088A74DD7DD19F69CB9A1A226BF43124CCD1FE
      Key-Arg   : None
      Start Time: 1555058725
      Timeout   : 300 (sec)
      Verify return code: 21 (unable to verify the first certificate)
  ---
  read:errno=0
  </code></pre>
  
  <p>Most of the answers about "php curl - SSL certificate problem: unable to get local issuer certificate" says about configuring php curl settings in localhost / mamp and adding <code>cacert.pem</code> and <code>ca-bundle.crt</code> manually. But in my case this is not a problem with php curl in my localhost as I can access other sites over https.</p>