Problem with ssl

[Mattpl]

Hi today i Have problem with ssl
file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
I was trying to update ca-cert and add into php.ini path to
openssl.cafile=/usr/lib/ssl/cert.pem
and still have problem

 

[Richard G]

I don't know what you are doing in php.ini to install a certificate. Where did you find to use that?

If you are using a purchased certificat this is an example.

How to Install an SSL Certificate Using DirectAdmin

A step-by-step guide on installing an SSL Certificate with DirectAdmin web control panel.

comodosslstore.com

routines:SSL3

We don't use SSL v3.

 

[ffarias]

Hello,

DST Root CA X3 Expiration (September 2021) - Let's Encrypt

Update Feb 05, 2024 It’s been two years, and the Android compatibility cross-sign mentioned below is close to expiring. See our recent blog post for a detailed explanation of the changes coming over the course of 2024. Update September 30, 2021 As planned, the DST Root CA X3 cross-sign has...

letsencrypt.org

You need to update the ca-certificates package.

 

[Richard G]

I don't think he's using Letsencrypt because in that case he has nothing to do with editting a php.ini or ca-cert file anyway.

So it's best to say first which certificate you are trying to install @Mattpl and in which way.

 

[Mattpl]

@Richard G
I'm using let encrypt free cert's and also i have do apt-get update ca-certificates and certs are up to date and still have this problem. My cert was create 25.08.2021 (free ssl from letsencrypt) and site was working ok for all these days, today at 16.05 my website go down and in logs I see error
file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed ath ./xx/xxx/news-widget.php at line 62

When I have comment in php file function which is using this file_get_contents (from https url) website is working

 

[Richard G]

I don't know which openssl version you are using. Seems that @ffarias was correct.

Maybe this can be of help to you.

Old Let's Encrypt Root Certificate Expiration and OpenSSL 1.0.2 - OpenSSL Blog

The currently recommended certificate chain as presented to Let’s Encrypt ACME clients when new certificates are issued contains an intermediate …

www.openssl.org

 

[ZyberSup]

DST Root CA X3 Expiration (September 2021) - Let's Encrypt

Update Feb 05, 2024 It’s been two years, and the Android compatibility cross-sign mentioned below is close to expiring. See our recent blog post for a detailed explanation of the changes coming over the course of 2024. Update September 30, 2021 As planned, the DST Root CA X3 cross-sign has...

letsencrypt.org

You need to update the ca-certificates package.

Thank you very much. It just solved my problem I found today.

After trying to update openssl 1.1 on CentOS 7 without success (because openssl on CentOS 7 will always be 1.0.2k). So I tried update ca-certificates and got the latest CA certificates updated successfully.

 

[Richard G]

so I tried update ca-certificates and got the latest CA certificates updated successfully.

Yep, Centos 7 and 8 have the new certificates which can be updated via yum.

@Mattpl maybe try again with apt-get if Debian has new certificates too?
Check if you get a new LE certificate if the issue is gone after that.