cURL错误60：SSL证书问题：证书已过期

Question

我们在amazon ec2(backend.abc.com和frontend.abc.com）上运行2个应用程序。对于该应用程序，我们使用了付费SSL证书。该证书的有效期为2021年6月。但今天，我们犯了一个错误-

cURL error 60: SSL certificate problem: certificate has expired (see http://curl.haxx.se/libcurl/c/libcurl-errors.html)

我们检查证书到期日期，但没有问题（2021年6月）。然后我们关注以下问题：Thread-curl:(60)SSL证书问题：无法获得本地颁发者证书(@Dahomz回答）

之后，当我们通过-curl-v--URL https://backend.abc.com--cacert/etc/ssl/ssl.cert/cacert.pem来curl abc.com时，它可以正常工作。反应类似-

* Rebuilt URL to: https://backend.abc.com/
*   Trying 127.0.0.1...
* Connected to backend.abc.com (127.0.0.1) port 443 (#0)
* found 139 certificates in /etc/ssl/ssl.cert/cacert.pem
* found 600 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ******_RSA_***_***_GCM_*****
*    server certificate verification OK
*    server certificate status verification SKIPPED
*    common name: *.abc.com (matched)
*    server certificate expiration date OK
*    server certificate activation date OK
*    certificate public key: RSA
*    certificate version: #3
*    subject: OU=Domain Control Validated,OU=PositiveSSL Wildcard,CN=*.abc.xyz
*    start date: Mon, 04 May 2019 00:00:00 GMT
*    expire date: Wed, 07 June 2021 23:59:59 GMT
*    issuer: C=GB,ST=Greater Manchester,L=Salford,O=Sectigo Limited,CN=Sectigo RSA Domain Validation Secure Server CA
*    compression: NULL
* ALPN, server accepted to use http/1.1

但是当我们用卷曲从frontend.abc.com到backend.abc.com时，它会抛出这个错误-

* Rebuilt URL to: https://backend.abc.com/
*   Trying 127.0.0.1...
* Connected to backend.abc.com (127.0.0.1) port 443 (#0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/ssl.cert/cacert.pem
  CApath: /etc/ssl/certs
* SSL connection using TLSv1.2 / *****-RSA-*****-GCM-******
* ALPN, server accepted to use http/1.1
* Server certificate:
*    subject: OU=Domain Control Validated; OU=PositiveSSL Wildcard; CN=*.abc.com
*    start date: Mar  4 00:00:00 2019 GMT
*    expire date: Apr  7 23:59:59 2021 GMT
*    issuer: C=GB; ST=Greater Manchester; L=Salford; O=Sectigo Limited; CN=Sectigo RSA Domain Validation Secure Server CA
*    SSL certificate verify result: certificate has expired (10), continuing anyway.

我的卷曲码-

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://backend.abc.com");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_VERBOSE, 1);
curl_setopt($ch, CURLOPT_STDERR, fopen(public_path("c.log"), 'w'));
curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
$output = curl_exec($ch);
$error = curl_error($ch);
$info = curl_getinfo($ch);
curl_close($ch);

Answer 1

若要解决此问题，请从域证书中删除过期的根证书。

1. 转到https://whatsmychaincert.com
2. 测试服务器
3. 如果他们确认您拥有过期的根证书，请下载并使用不带此证书的.crt。

（可选）当您这样做的时候，您可以使用这个临时卷曲修复，以避免在您的网站上出现错误：添加这个选项：

curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, 0);