Dealing with SSL Errors

Postmark-PHP utilizes a PHP extension called libcurl. Depending on various system settings, the default installation of libcurl can have issues verifying SSL/TLS certificates.

This results in error messages like the following:

cURL error 60: SSL certificate problem: unable to get local issuer certificate in...

Although it's not a problem specific to the Postmark library, we see it frequently enough that we wanted to share how to resolve it, when you're developing on Windows.

OPTION 1 (Harder, but more secure):

1. Download and save the CA bundle, to a location of your choice, perhaps c:\curl_ca_bundle.crt

2. In c:\windows, if there is not already a php.ini text file, create one.

3. Add or update the following lines to the php.ini:

   [PHP]
   curl.cainfo=c:\curl_ca_bundle.crt

4. Run your PHP scripts as normal.

This process will ensure you have the appropriate certificate chain needed to allow libcurl to verify the SSL/TLS certificates presented by the Postmark API, as well as many other Web Services.

OPTION 2 (Easier, but less secure):

After you require the Postmark library into your project, set the following global setting:

PostmarkClientBase::$VERIFY_SSL = false

This will still allow you to connect to the Postmark API using a TLS connection (which is encrypted), but it's possible that a Man-in-the-middle attack could impersonate the Postmark API, and this would go undetected by your client code.

OPTION 3 (Not recommended):

After you require the Postmark library into your project, set the following global setting:

PostmarkClientBase::$BASE_URL = 'http://api.postmarkapp.com';

This is a last-resort option when you are using PHP in a system where SSL/TLS is not available. Your interactions with Postmark will be sent in plain-text and are at a much higher-risk of eavesdropping from 3rd parties. We do not recommend this solution, but some special circumstances may leave you with only this option.