(60) SSL certificate problem: unable to get local issuer certificate

I have a new problem with my PayPal Express Checkout module.

When I go to purchase a test item, I am given the message of:

An error occurred when we tried to contact the payment processor. Please try again, select an alternate payment method, or contact the store owner for assistance. () - (60) SSL certificate problem: unable to get local issuer certificate

I have already RE-followed the steps at the following URL:

http://www.zen-cart.com/showthread.php?213892-Curl-error-%2860%29-SSL-Certificate-problem-Unable-to-get-local-issuer-certificate

When I go to the last step (curltester.php), I get the following:

Connecting to PayPal IPN (port 443)...
GOOD: Socket established

Error 60: SSL certificate problem: unable to get local issuer certificate
IMPORTANT NOTE: Error 60 or 61 means that this server has an SSL certificate configuration problem. YOU NEED TO ASK YOUR HOSTING COMPANY SERVER ADMIN FOR ASSISTANCE with fixing the server's OpenSSL certificate chain. 
This error has nothing to do with Zen Cart. It is a server configuration issue.

I have checked my php.ini settings, the path to the cacert.pem is fine (just like it was before when checkout's were working). This problem has just recently started.

What can I do?

Your help is appreciated!!

Have you perchance checked the permissions of the folder/file leading to the cert? I am guessing only, but it seems that the issue is that the cert can not be found, so if in fact the path to the cert is correct in the php.ini file and if that is the only cert that is needed/expected in order to address that issue (ie, host truly doesn't have anything to do with it), then that's the one thing I come/came up with..

mc12345678:

Have you perchance checked the permissions of the folder/file leading to the cert? I am guessing only, but it seems that the issue is that the cert can not be found, so if in fact the path to the cert is correct in the php.ini file and if that is the only cert that is needed/expected in order to address that issue (ie, host truly doesn't have anything to do with it), then that's the one thing I come/came up with..

This website uses IIS as its web service (on a Windows server). Would you, or anyone else who reads this know which account to give rights to and how much rights to the folder containing that cert?

Thanks for replying!

I have given the IIS_IUSRS group read/write permissions to the SSL folder containing the cacert.pem file, rebooted the server and tried again; still does not work. The curltester.php still throws the same error (60).

I had the same or similar problem. I'm using ZenCart 1.5.0. The way I fixed it was to replace my old PayPal .php file with the same file from v1.5.4.. I believe it was either 1 or 2 files. I can't remember exactly where they were or which ones, but seems like there's only a few, and not hard to find. Someone here will be able to tell you which ones I'm talking about. Note: Don't take my word for anything, and check with someone else before you do this.. and back up your original files, always. The problem I had may be nothing like the problem you have, but I just wanted to mention it to you.

Johnnycopilot:

I had the same or similar problem. I'm using ZenCart 1.5.0. The way I fixed it was to replace my old PayPal .php file with the same file from v1.5.4.. I believe it was either 1 or 2 files. I can't remember exactly where they were or which ones, but seems like there's only a few, and not hard to find. Someone here will be able to tell you which ones I'm talking about. Note: Don't take my word for anything, and check with someone else before you do this.. and back up your original files, always. The problem I had may be nothing like the problem you have, but I just wanted to mention it to you.

Johnny, I just updated from 1.5.3 to 1.5.4. Weren't the PayPal files overwritten anyway with this update to the 1.5.4 ones?

jokkah, sorry I don't know if 1.5.3 and 1.5.4 ZenCart PayPal files are the same. Did upgrading to 1.5.4 just now fix your PayPal problem?

Johnnycopilot:

jokkah, sorry I don't know if 1.5.3 and 1.5.4 ZenCart PayPal files are the same. Did upgrading to 1.5.4 just now fix your PayPal problem?

No, the problem still exists. :/

I have now added more VeriSign CA's to my cacert.pem file and rebooted my web server. I am STILL GETTING error 60's (SSL certificate problem: unable to get local issuer certificate)

Why is this having problems checking the CA's when it tries to do a cURL test to the PayPal Express endpoint?? This did not happen before!

I have already checked the directory permissions where the PEM file is, heck, I even gave "Everyone" full control (highly NOT recommended in any scenario) and tested and it gave the same error 60..

Update : The error (60) is only happening during the curltester.php for the following endpoints:

• PayPal Express/Pro Server
• PayPal Payflowpro Server
• AuthorizeNet Production Server

The rest of the endpoints, GOOD.

Below each of the fails for the above endpoints:

Testing again with less security...
GOOD: CURL Connection successful. (but without being able to verify certificate chain. Again: this is a server issue, not a Zen Cart issue.)

It is seeing the cacert.pem, but apparently something is going wrong between the CA's listed in the cacert.pem and the ones the above endpoints are using?

jokkah:

I have a new problem with my PayPal Express Checkout module.

When I go to purchase a test item, I am given the message of:

An error occurred when we tried to contact the payment processor. Please try again, select an alternate payment method, or contact the store owner for assistance. () - (60) SSL certificate problem: unable to get local issuer certificate

> 
> I have already RE-followed the steps at the following URL:
> 
> <http://www.zen-cart.com/showthread.php?213892-Curl-error-%2860%29-SSL-Certificate-problem-Unable-to-get-local-issuer-certificate>
> 
> When I go to the last step (curltester.php), I get the following:
> 
> ```
Connecting to PayPal IPN (port 443)...
GOOD: Socket established

Error 60: SSL certificate problem: unable to get local issuer certificate
IMPORTANT NOTE: Error 60 or 61 means that this server has an SSL certificate configuration problem. YOU NEED TO ASK YOUR HOSTING COMPANY SERVER ADMIN FOR ASSISTANCE with fixing the server's OpenSSL certificate chain. 
This error has nothing to do with Zen Cart. It is a server configuration issue.

I have checked my php.ini settings, the path to the cacert.pem is fine (just like it was before when checkout's were working). This problem has just recently started.

What can I do?

Your help is appreciated!!

I am having the same issue. Everything working fine then - (60) SSL certificate problem: unable to get local issuer certificate on checkout.

I'm on IIS, PHP 5.4.9, PHP.ini has path to the cacert.pem.

jbaggs:

I am having the same issue. Everything working fine then - (60) SSL certificate problem: unable to get local issuer certificate on checkout.

I'm on IIS, PHP 5.4.9, PHP.ini has path to the cacert.pem.

Yep and I see PayPal uses the 'VeriSign Class 3 Primary CA - G5' Certificate Authority, WHICH my cacert.pem HAS. That further confuses me because curl should be seeing that and trusting it.

jokkah:

Yep and I see PayPal uses the 'VeriSign Class 3 Primary CA - G5' Certificate Authority, WHICH my cacert.pem HAS. That further confuses me because curl should be seeing that and trusting it.

I could be way off the mark here (I don't do Windows), but if the cacert.pem has write permissions it probably wouldn't be trusted.

Cheers
RodG

RodG:

I could be way off the mark here (I don't do Windows), but if the cacert.pem has write permissions it probably wouldn't be trusted.

Cheers
RodG

Can you provide some credible theory to that response, please?

jokkah:

Can you provide some credible theory to that response, please?

Seems oxymoronic to ask for a theory (which is more of a concept) to be credible (based on fact.)

Stepping onto the soapbox

If the answer to such a request is the only reason for which to attempt a change, it would appear that the suggested use of a development site where the effects of a "mistake" or unsuccesful attempt are simply reversed by "restoring" the files...

Beyond that, it would seem that the suggestiong/theory was already described as one provided without intimate knowledge of Windows. As such it seems appropriate to ask what additional information could be provided to give credibility as regardless of the accuracy, completeness and more than likely truthfulness of the statement the absence of such specific experience would be all the more reason to then advise that the action (however minute) ought not be performed because of such said specific experience...

Basically said, all I see is that action will only be taken/attempted once some "level" of information is provided/taught (though I think RodG would also welcome the opportunity to provide some such education.)

Alright off the soapbox.

jokkah:

Can you provide some credible theory to that response, please?

If the certs are able to be written to, they can be altered, If they can be altered they can't be trusted.

As I said, I don't do windows. It's a theory.

Cheers
RodG

:shocking:@mc12345678 I...uhhhh....ummmmm....what? I read that 3 times, and still I can't get through it all the way before my brain shuts down...nope tried again..nothin'...lol. it makes me feel like a trapped jury member in a Apple versus Samsung lawsuit and nobody know what the lawyers are talking about

barco57:

:shocking:@mc12345678 I...uhhhh....ummmmm....what? I read that 3 times, and still I can't get through it all the way before my brain shuts down...nope tried again..nothin'...lol. it makes me feel like a trapped jury member in a Apple versus Samsung lawsuit and nobody know what the lawyers are talking about

Good... Point made...

It's a lot like stating: the next sentence is wrong.
the last sentence is right.

Albeit, rodg in my view provided the same answer a second time but reworded. (Understand some learn differently than others), but there was no more of a credible theory than previously provided. If saying the same thing over and over again makes a truth, then it's no wonder that the world isn't a bigger mess. :)

Hi jokkah,
Did you solve this problem? I appear to have exactly the same issue as curltester.php continues to give me:

IMPORTANT NOTE: Error 60 or 61 means that this server has an SSL certificate configuration problem. YOU NEED TO ASK YOUR HOSTING COMPANY SERVER ADMIN FOR ASSISTANCE with fixing the server's OpenSSL certificate chain.
I followed the suggestion to "manually configuring the CURLOPT_CAINFO value with a legitimate CA bundle" and downloaded a cacert.pem to my server. I know the path to cacert.pem is working correctly because I got a "file not found" type of error as soon as I deleted it.

Background
My hosting company asked me to relocate to a new server so I took the opportunity to upgrade from v1.3.9. I installed v.1.5.4 on the new server, copied my v.1.3.9 data to a new database, then used the fresh v1.5.4 install to upgrade my data. All seemed good until it came time to complete the first Paypal transaction.
I've been working with my hosting company but they've run out of options.
Other details: Windows server. PHP Version: 5.4.23 (Zend: 2.4.0). Database: MySQL 5.6.19-log. HTTP Server: Microsoft-IIS/8.5.

Any help would be much appreciated. Mick.

mick9876:

I've been working with my hosting company but they've run out of options.

Eeeek, a hosting company that can't sort out SSL/Certificate related issues.... If I were you I'd be seeking another host. Fast!.

Cheers
RodG