Paypal Access - SSL certificate: unable to get local issuer certificate

Question

I'm working with cUrl and PHP to make a request to a server (for paypal access)

Paypal developer website does never mention that an SSL certificate is required to use PayPal access API, however the code that I use to request the token is the following:

$options = array(                 CURLOPT_URL => $url,                 CURLOPT_POST => 1,                 CURLOPT_VERBOSE => 1,                 CURLOPT_POSTFIELDS => $postvals,                 CURLOPT_RETURNTRANSFER => 1,                 CURLOPT_SSLVERSION => 3 );  curl_setopt_array($ch, $options);  $response = curl_exec($ch);  echo curl_error($ch); 

This echo outputs the following error:

SSL certificate problem: unable to get local issuer certificate 

My questions are:

1) do I need SSL to use paypal access if I need only to get the user email?

2) if I do not need SSL why this error occours?

PS: the endpoint is the following: https://www.sandbox.paypal.com/webapps/auth/protocol/openidconnect/v1/tokenservice

Answer 1

The correct solution is to fix your PHP setup.. setting CURLOPT_SSL_VERIFYPEER to false is a quick hack, but it's wrong as you disable the certificate validation by it's certificate authority. This exposes you to a man-in-the-middle attack.

It's easy to fix (php 5.3.7 or higher) - Download a list file with an up-to-date certificate authorities, and add this setting to your php.ini
curl.cainfo=<path-to>cacert.pem

Restart your web server, and it'll work !

Answer 2

You may disable SSL verification (which is enabled by default as of cURL 7.10), by adding this:

CURLOPT_SSL_VERIFYPEER, false 

to your $options, however the proper way is to keep validation enabled.

SECURITY NOTICE

If remote site uses certificate issued by known CA but validation still fails, then most likely certificate is incorrectly set up on the remote server (lack of intermediate certificates etc.). Alternatively your system got no idea about used Certificate Authority that signed target's certificate. In such case yo should use php.ini's curl.cainfo (documentation) to point to valid PEM file with all supported CAs - that would make your setup properly validate issuer chain.

Please be aware that by setting CURLOPT_SSL_VERIFYPEER to false you are NOT solving the issue! You are working it around. This is all about security so it's fine to do that for a while, but deploying that on production is not wise, politely speaking, as you will become open to Man In The Middle Attack. You have been warned.