How to Fix "cURL Error 60: SSL Certificate Problem: Unable to Get Local Issuer Cert"
Google AdSense In-Article Display Placement
Publisher ID: ca-pub-XXXXXXXXXXXXXXXX (Configured in config.php)When PHP cURL calls an external HTTPS API (Stripe, PayPal, Google, WordPress.org), it verifies the remote server's certificate. On local Windows/XAMPP environments without an active CA bundle, verification fails with error 60.
Download the official CA cert bundle "cacert.pem" from curl.se/ca/cacert.pem. Save it to "C:\xampp\php\extras\ssl\cacert.pem". Then open "php.ini", find "curl.cainfo", and set: curl.cainfo = "C:\xampp\php\extras\ssl\cacert.pem". Restart Apache. Never disable CURLOPT_SSL_VERIFYPEER!
📋 Guide Table of Contents
1. Problem Diagnosis & Symptoms
Unlike web browsers which ship with built-in CA stores, PHP on Windows requires an explicit path to a Certificate Authority bundle file.
2. Primary Root Causes
- Cause: Missing curl.cainfo and openssl.cafile in php.ini.
3. Step-by-Step Diagnostic Fixes
Configure curl.cainfo in php.ini
Edit php.ini:
curl.cainfo = "C:\xampp\php\extras\ssl\cacert.pem"
openssl.cafile = "C:\xampp\php\extras\ssl\cacert.pem"4. How to Verify the Resolution
- Execute cURL call to https://httpbin.org/get and verify 200 response.
5. Diagnostic Troubleshooting Matrix
| Symptom Observed | Root Cause | Recommended Action |
|---|---|---|
| cURL error 60 continues after editing php.ini | Backslashes in Windows file path not escaped or Apache not restarted | Wrap path in double quotes and restart Apache |
6. Critical Mistakes to Avoid
- ❌ Never set CURLOPT_SSL_VERIFYPEER = false in production (allows Man-in-the-Middle attacks).
7. Frequently Asked Questions
❓ Where does the official cacert.pem bundle originate?
It is compiled directly from Mozilla's trusted root certificates repository.
Official Technical References
Google AdSense In-Article Matched Content Unit