(60) SSL certificate problem: unable to get local issuer certificate

Update : The error (60) is only happening during the curltester.php for the following endpoints:

- PayPal Express/Pro Server
- PayPal Payflowpro Server
- AuthorizeNet Production Server

The rest of the endpoints, GOOD.

Below each of the fails for the above endpoints:

Code:

---

Testing again with less security...
GOOD: CURL Connection successful. (but without being able to verify certificate chain. Again: this is a server issue, not a Zen Cart issue.)

---

It is seeing the cacert.pem, but apparently something is going wrong between the CA's listed in the cacert.pem and the ones the above endpoints are using?

Quote:

---

Originally Posted by jokkah

I have a new problem with my PayPal Express Checkout module.

When I go to purchase a test item, I am given the message of:

Code:

---

An error occurred when we tried to contact the payment processor. Please try again, select an alternate payment method, or contact the store owner for assistance. () - (60) SSL certificate problem: unable to get local issuer certificate

---

I have already RE-followed the steps at the following URL:

http://www.zen-cart.com/showthread.p...er-certificate

When I go to the last step (curltester.php), I get the following:

Code:

---

Connecting to PayPal IPN (port 443)...
GOOD: Socket established

Error 60: SSL certificate problem: unable to get local issuer certificate
IMPORTANT NOTE: Error 60 or 61 means that this server has an SSL certificate configuration problem. YOU NEED TO ASK YOUR HOSTING COMPANY SERVER ADMIN FOR ASSISTANCE with fixing the server's OpenSSL certificate chain.
This error has nothing to do with Zen Cart. It is a server configuration issue.

---

I have checked my php.ini settings, the path to the cacert.pem is fine (just like it was before when checkout's were working). This problem has just recently started.

What can I do?

Your help is appreciated!!

---

I am having the same issue. Everything working fine then - (60) SSL certificate problem: unable to get local issuer certificate on checkout.

I'm on IIS, PHP 5.4.9, PHP.ini has path to the cacert.pem.

Quote:

---

Originally Posted by jbaggs

I am having the same issue. Everything working fine then - (60) SSL certificate problem: unable to get local issuer certificate on checkout.

I'm on IIS, PHP 5.4.9, PHP.ini has path to the cacert.pem.

---

Yep and I see PayPal uses the 'VeriSign Class 3 Primary CA - G5' Certificate Authority, WHICH my cacert.pem HAS. That further confuses me because curl should be seeing that and trusting it.

Quote:

---

Originally Posted by jokkah

Yep and I see PayPal uses the 'VeriSign Class 3 Primary CA - G5' Certificate Authority, WHICH my cacert.pem HAS. That further confuses me because curl should be seeing that and trusting it.

---

I could be way off the mark here (I don't do Windows), but if the cacert.pem has write permissions it probably wouldn't be trusted.

Cheers
RodG

Quote:

---

Originally Posted by RodG

I could be way off the mark here (I don't do Windows), but if the cacert.pem has write permissions it probably wouldn't be trusted.

Cheers
RodG

---

Can you provide some credible theory to that response, please?

Quote:

---

Originally Posted by jokkah

Can you provide some credible theory to that response, please?

---

Seems oxymoronic to ask for a theory (which is more of a concept) to be credible (based on fact.)

Stepping onto the soapbox

If the answer to such a request is the only reason for which to attempt a change, it would appear that the suggested use of a development site where the effects of a "mistake" or unsuccesful attempt are simply reversed by "restoring" the files...

Beyond that, it would seem that the suggestiong/theory was already described as one provided without intimate knowledge of Windows. As such it seems appropriate to ask what additional information could be provided to give credibility as regardless of the accuracy, completeness and more than likely truthfulness of the statement the absence of such specific experience would be all the more reason to then advise that the action (however minute) ought not be performed because of such said specific experience...

Basically said, all I see is that action will only be taken/attempted once some "level" of information is provided/taught (though I think RodG would also welcome the opportunity to provide some such education.)

Alright off the soapbox.

Quote:

---

Originally Posted by jokkah

Can you provide some credible theory to that response, please?

---

If the certs are able to be written to, they can be altered, If they can be altered they can't be trusted.

As I said, I don't do windows. It's a theory.

Cheers
RodG

:shocking:@mc12345678 I...uhhhh....ummmmm....what? I read that 3 times, and still I can't get through it all the way before my brain shuts down...nope tried again..nothin'...lol. it makes me feel like a trapped jury member in a Apple versus Samsung lawsuit and nobody know what the lawyers are talking about

Quote:

---

Originally Posted by barco57

:shocking:@mc12345678 I...uhhhh....ummmmm....what? I read that 3 times, and still I can't get through it all the way before my brain shuts down...nope tried again..nothin'...lol. it makes me feel like a trapped jury member in a Apple versus Samsung lawsuit and nobody know what the lawyers are talking about

---

Good... Point made...

It's a lot like stating: the next sentence is wrong.
the last sentence is right.

Albeit, rodg in my view provided the same answer a second time but reworded. (Understand some learn differently than others), but there was no more of a credible theory than previously provided. If saying the same thing over and over again makes a truth, then it's no wonder that the world isn't a bigger mess. :)

Hi jokkah,
Did you solve this problem? I appear to have exactly the same issue as curltester.php continues to give me:

Quote:

---

IMPORTANT NOTE: Error 60 or 61 means that this server has an SSL certificate configuration problem. YOU NEED TO ASK YOUR HOSTING COMPANY SERVER ADMIN FOR ASSISTANCE with fixing the server's OpenSSL certificate chain.

---

I followed the suggestion to "manually configuring the CURLOPT_CAINFO value with a legitimate CA bundle" and downloaded a cacert.pem to my server. I know the path to cacert.pem is working correctly because I got a "file not found" type of error as soon as I deleted it.

Background
My hosting company asked me to relocate to a new server so I took the opportunity to upgrade from v1.3.9. I installed v.1.5.4 on the new server, copied my v.1.3.9 data to a new database, then used the fresh v1.5.4 install to upgrade my data. All seemed good until it came time to complete the first Paypal transaction.
I've been working with my hosting company but they've run out of options.
Other details: Windows server. PHP Version: 5.4.23 (Zend: 2.4.0). Database: MySQL 5.6.19-log. HTTP Server: Microsoft-IIS/8.5.

Any help would be much appreciated. Mick.