SSL certificate problem: unable to get local issuer certificate

[Trainmaster]

After updating from 1.1.0 to 1.2.2 the following error occured in my development environment (Windows).

Unable to complete request.[SSL certificate problem: unable to get local issuer certificate]

On the production environment (Debian) everything was fine. So I was wondering what the problem is until I read this: http://stackoverflow.com/a/29115499/2265842.

Applied to the problem as outlined above I looks like the provided certificate vimeo-api.pem isn't even used on Debian. And on Windows (which has no default certificates) vimeo-api.pem is used, but without success. My conclusion is that the provided certificate vimeo-api.pem is incorrect and/or incomplete (and maybe not necessary?).

Finally I was thinking about how to fix that problem. First I commented out the line

CURLOPT_CAINFO => realpath(__DIR__ .'/../..') . self::CERTIFICATE_PATH

in Vimeo\Vimeo.php. Secondly I set the php.ini option curl.cainfo on my Windows environment using cacert.pem downloaded from http://curl.haxx.se/ca/cacert.pem. And finally it's working on Windows, too.

So either vimeo-api.pem must be fixed or CURLOPT_CAINFO should not be set and the system must provide the certificates.

[Dashron]

Glad you have a temporary fix. The cert we provide in vimeo-api.pem is the intermediary cert, and works fine for me in php on ubuntu. Adding my notes below for reference.

1. Set up vimeo.php from a fresh composer install and the index.php example pulled from github (required init.php and config.json)
2. index.php worked fine from fresh install
3. removed the cainfo option, index.php worked fine
4. Restored the cainfo, and changed the cert to a valid cert that was not involved in the vimeo api chain, and php threw an error

This means that vimeo.php on ubuntu is using vimeo-api.pem, and is ensuring that it is valid.

I'll test a windows machine tomorrow morning, and follow these steps with the existing certs. I'll let you know my findings.

[kenyavs]

Curious, do you still receive errors with the curl.cainfo php.ini option set along with the line CURLOPT_CAINFO => realpath(__DIR__ .'/../..') . self::CERTIFICATE_PATH uncommented out?

[Trainmaster]

Concerning curl.cainfo the documentation says:

A default value for the CURLOPT_CAINFO option.

So I don't think it will have an effect along with the line mentioned.

[beltofte]

Experiencing some similar issues on OSX.

Primarily using Acquia Dev Desktop as local development environment - mostly working on Drupal stuff. It throws the same SSL error. It's running PHP 5.3.29 and have a curl.cacert configured to use local cacert.pem certificate. See copy of the phpinfo() file at https://dl.dropboxusercontent.com/u/2381238/stuff/github_vimeo_ssl_issue_acquia_dev_desktop_phpinfo.html.

Also have MAMP Pro installed for stuff that is not compatible with Dev Desktop. It is also running PHP 5.3.29 and do not have a certificate set in curl.cacert. See the phpinfo() at https://dl.dropboxusercontent.com/u/2381238/stuff/github_vimeo_ssl_issue_mamp_phpinfo.html.

What is funny is that it works fine on MAMP Pro, but not on Dev Desktop. They are both using the same version of cURL. Dev Desktop is using a never version of OpenSSL though (OpenSSL/1.0.1h). MAMP has IDN enabled in the cURL configuration, Dev Desktop has not.

Removing curl.cacert from the Dev Desktop environment is not solving the issue.

Working on fixing some issues in the Drupal module vimeo_video_uploader, so really need it up running on Dev Desktop.

Any ideas why it does not work on one of the environments?

[Trainmaster]

@beltofte
Are you talking about the php.ini option curl.cainfo by saying curl.cacert? If so then you should carefully read my first post. You should not modifiy the php.ini but comment out the above-named line in Vimeo\Vimeo.php.

By the way: phpinfo() doesn't expose the option curl.cainfo set in php.ini.

[Dashron]

I've just updated our documentation with improved certificate troubleshooting information. Take a look and let me know if it solves your problem: https://github.com/vimeo/vimeo.php/blob/master/README.md#troubleshooting

[Trainmaster]

@Dashron
It solves the problem (as expected). So will the root certificate be added to certificates/vimeo-api.pem?

[Dashron]

I need to do more research before I can give a concrete answer about that.

[Dashron]

Yeah, we'll add it soon. There were some security concerns around including it, but php curl invalidates most of those concerns.

[Dashron]

Follow this for more: #75

[jcn50]

I replaced the vimeo-api.pem by http://curl.haxx.se/ca/cacert.pem provided by @Trainmaster , and it fixed the problem! Thanks!

[tmiecz]

Correct URL for pem:
https://curl.se/ca/cacert.pem

Thanks!