title: PHP CURL and SSL certificate (or cert chain)
body: <p>Good day!</p>
  
  <p>I've REST API which is accessible via SSL (https://). I'd like to put correct cert (or cert chain) along with my scripts written PHP and CURL to make request. </p>
  
  <p>Here are how certs from my target (<a href="http://api.vkontakte.ru" rel="nofollow noreferrer">http://api.vkontakte.ru</a>) look like in Firefox:</p>
  
  <p><a href="http://speedcap.net/img/bc687485819715c65d6fe1e4ca1fdc40/1a2be.png" rel="nofollow noreferrer">http://speedcap.net/img/bc687485819715c65d6fe1e4ca1fdc40/1a2be.png</a></p>
  
  <p>Here is a snippet from saved "cert chain X.509 in PEM format" from Firefox
  (described here: <a href="http://unitstep.net/blog/2009/05/05/using-curl-in-php-to-access-https-ssltls-protected-sites/" rel="nofollow noreferrer">http://unitstep.net/blog/2009/05/05/using-curl-in-php-to-access-https-ssltls-protected-sites/</a>):</p>
  
  <pre><code>-----BEGIN CERTIFICATE-----
  MIIFVzCCBD+gAwIBAgIHKx5Ov2FOejANBgkqhkiG9w0BAQUFADCByjELMAkGA1UE
  [..skip...]
  0npsf5fkvT8E13NgVY0PK6V/baMTlTgWXKQZ
  -----END CERTIFICATE-----
  -----BEGIN CERTIFICATE-----
  MIIE3jCCA8agAwIBAgICAwEwDQYJKoZIhvcNAQEFBQAwYzELMAkGA1UEBhMCVVMx
  [..skip...]
  qDTMBqLdElrRhjZkAzVvb3du6/KFUJheqwNTrZEjYx8WnM25sgVjOuH0aBsXBTWV
  U+4=
  -----END CERTIFICATE-----
  </code></pre>
  
  <p>Here is code example of CURL init:</p>
  
  <pre><code>$this-&gt;ch = curl_init();
      curl_setopt_array($this-&gt;ch, array(
  
          CURLOPT_TIMEOUT =&gt; 30,
          CURLOPT_RETURNTRANSFER =&gt; TRUE,
          CURLOPT_AUTOREFERER =&gt; TRUE,
          CURLOPT_FOLLOWLOCATION =&gt; TRUE,
  
          CURLOPT_SSL_VERIFYPEER =&gt; TRUE,
          CURLOPT_SSL_VERIFYHOST =&gt; 2,
          CURLOPT_CAINFO =&gt; &lt;path to my cert&gt;,        
      )); 
  </code></pre>
  
  <p>I've got CURL error 60 (<code>CURLE_SSL_CACERT</code>) complaining about wron cert.</p>
  
  <p>What I've tried:</p>
  
  <ul>
  <li><p>I've verified that my cert file is used, because when I specify wrong path it complains that it can't find cert (error 70)</p></li>
  <li><p>I've checked with Facebook SDK and their cert chain that my CURL works with such setup</p></li>
  <li><p>I've tried to export different chains (including or excluding) last cert in chain</p></li>
  <li><p>Tried <code>CURLOPT_SSL_VERIFYHOST =&gt; 1</code>.  </p></li>
  </ul>
  
  <p>Any ideas are welcome!  </p>