cURL错误60：SSL证书问题：证书已过期 [英] cURL error 60: SSL certificate problem: certificate has expired

问题描述

我们在Amazon EC2（ backend.abc.com 和 frontend.abc.com ）上运行了2个应用程序。对于该应用程序，我们使用了付费的SSL证书。该证书的到期日期为 2021年6月。但是今天，我们遇到了一个错误-

We running 2 application on amazon ec2 (backend.abc.com & frontend.abc.com). For that application, we used a paid SSL Certificate. That certificate expiration date at 2021 June. But today, we got an error -

cURL error 60: SSL certificate problem: certificate has expired (see http://curl.haxx.se/libcurl/c/libcurl-errors.html)

我们检查证书的到期日期，但是没有问题（ 2021年6月）。然后，我们遵循此线程- curl：（60 ）SSL证书问题：无法获取本地颁发者证书（@Dahomz回答）

We check certificate expiration date, but there was no problem (2021 June). Then we follow this thread - curl: (60) SSL certificate problem: unable to get local issuer certificate (@Dahomz answer)

之后，当我们通过- curl卷曲abc.com时- v --url https://backend.abc.com --cacert /etc/ssl/ssl.cert/cacert.pem ，工作正常。响应-

After that, when we curl abc.com by - curl -v --url https://backend.abc.com --cacert /etc/ssl/ssl.cert/cacert.pem, It working fine. Response like -

* Rebuilt URL to: https://backend.abc.com/
*   Trying 127.0.0.1...
* Connected to backend.abc.com (127.0.0.1) port 443 (#0)
* found 139 certificates in /etc/ssl/ssl.cert/cacert.pem
* found 600 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ******_RSA_***_***_GCM_*****
*    server certificate verification OK
*    server certificate status verification SKIPPED
*    common name: *.abc.com (matched)
*    server certificate expiration date OK
*    server certificate activation date OK
*    certificate public key: RSA
*    certificate version: #3
*    subject: OU=Domain Control Validated,OU=PositiveSSL Wildcard,CN=*.abc.xyz
*    start date: Mon, 04 May 2019 00:00:00 GMT
*    expire date: Wed, 07 June 2021 23:59:59 GMT
*    issuer: C=GB,ST=Greater Manchester,L=Salford,O=Sectigo Limited,CN=Sectigo RSA Domain Validation Secure Server CA
*    compression: NULL
* ALPN, server accepted to use http/1.1

我们通过curl从 frontend.abc.com 到backend.abc.com命中，则会引发此错误-

But when we hit from frontend.abc.com to backend.abc.com by curl, it throws this error -

* Rebuilt URL to: https://backend.abc.com/
*   Trying 127.0.0.1...
* Connected to backend.abc.com (127.0.0.1) port 443 (#0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/ssl.cert/cacert.pem
  CApath: /etc/ssl/certs
* SSL connection using TLSv1.2 / *****-RSA-*****-GCM-******
* ALPN, server accepted to use http/1.1
* Server certificate:
*    subject: OU=Domain Control Validated; OU=PositiveSSL Wildcard; CN=*.abc.com
*    start date: Mar  4 00:00:00 2019 GMT
*    expire date: Apr  7 23:59:59 2021 GMT
*    issuer: C=GB; ST=Greater Manchester; L=Salford; O=Sectigo Limited; CN=Sectigo RSA Domain Validation Secure Server CA
*    SSL certificate verify result: certificate has expired (10), continuing anyway.

我的卷曲代码-

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://backend.abc.com");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_VERBOSE, 1);
curl_setopt($ch, CURLOPT_STDERR, fopen(public_path("c.log"), 'w'));
curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
$output = curl_exec($ch);
$error = curl_error($ch);
$info = curl_getinfo($ch);
curl_close($ch);

推荐答案

要解决此问题，请从中删除过期的根证书您的域证书。

To fix the problem, remove the expired root certificate from your domain certificate.

1. 转到 https：/ /whatsmychaincert.com


2. 测试服务器


3. 如果他们确认您拥有过期的根证书，请下载并使用.crt没有此证书。

（可选）在执行此操作时，可以使用此临时curl修复程序来避免此错误t您的网站上没有错误：
添加此选项：

(optional) By the time you're doing that you can use this temporary curl fix in order to don't have an error on your website : Add this option :

curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, 0);

这篇关于cURL错误60：SSL证书问题：证书已过期的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！