PHP cURL - SSL certificate problem: unable to get local issuer certificate - ssl

Question

I'm trying to access an url which has SSL certification and use https using php curl. The curl options are set as follows.
$url = 'https://example.com';
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => $url,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_SSL_VERIFYPEER => true,
CURLOPT_SSL_VERIFYHOST => 2,
CURLOPT_POST => true,
]);
$curlResponce = curl_exec($curl);
$curlError = curl_error($curl);
curl_close($curl);
The above curl code returns the following error.
SSL certificate problem: unable to get local issuer certificate
But when I visit the same url using a browser, it displays the web page correctly without any issue in the SSL certificate. If I use the same to code to access https://www.google.com, Google page is displayed without any errors.
The web site "https://example.com" is hosted in AWS and uses a SSL certificate issued by RapidSSL RSA CA 2018. The certificate is not expired.
When I use openssl in command line to test "https://example.com" following verify errors are occurred.
Hasanta:~ hsumudupriya$ openssl s_client -connect example.com:443
CONNECTED(00000003)
depth=0 /CN=www.example.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /CN=www.example.com
verify error:num=27:certificate not trusted
verify return:1
depth=0 /CN=www.example.com
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:/CN=www.example.com
i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=RapidSSL RSA CA 2018
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFwjCCBKqgAwIBAgIQAd3vbVFjNnIlyEHjmZChmzANBgkqhkiG9w0BAQsFADBe
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMR0wGwYDVQQDExRSYXBpZFNTTCBSU0EgQ0EgMjAxODAe
Fw0xOTAxMjEwMDAwMDBaFw0yMDAxMjExMjAwMDBaMB0xGzAZBgNVBAMTEnd3dy5w
ZXdlbGRiYW5rLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAO4z
N+NKUcPlq2awP7+DWPHuE8zoD339v3c8ge1dxHh4XtMsxhDrP03etDCjZjr04AKS
/eTFdFrpATX8zbhxrUj7w0mbXTWgS2ruxQgYeQGRCwvXHCyGcBREXzIsNRh39fZw
x+kAby+bUymAeQ3ixI2ChCNH9PU5IBZ9WiLHI9d5nW8SkhO7ThcsHItamOEqPIQ7
vbu9b/gYvx0FQ+u24gZYazpWDDxqtYhJzGMLT9WEA35oD94CsRUXdvPv7TjjsTb9
Y9qLy/7SDGMmP6S/PIa2Wp2TaIW5UvgBUEDmRMMzHOePREeyGTC8KtSHYxtbMJyd
RkA3PIVbEM28PLnuoCMCAwEAAaOCArswggK3MB8GA1UdIwQYMBaAFFPKF1n8a8AD
IS8aruSqqByCVtp1MB0GA1UdDgQWBBRx/2R+46KD96n1weCytLRP74jGgDAtBgNV
HREEJjAkghJ3d3cucGV3ZWxkYmFuay5jb22CDnBld2VsZGJhbmsuY29tMA4GA1Ud
DwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwPgYDVR0f
BDcwNTAzoDGgL4YtaHR0cDovL2NkcC5yYXBpZHNzbC5jb20vUmFwaWRTU0xSU0FD
QTIwMTguY3JsMEwGA1UdIARFMEMwNwYJYIZIAYb9bAECMCowKAYIKwYBBQUHAgEW
HGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwCAYGZ4EMAQIBMHUGCCsGAQUF
BwEBBGkwZzAmBggrBgEFBQcwAYYaaHR0cDovL3N0YXR1cy5yYXBpZHNzbC5jb20w
PQYIKwYBBQUHMAKGMWh0dHA6Ly9jYWNlcnRzLnJhcGlkc3NsLmNvbS9SYXBpZFNT
TFJTQUNBMjAxOC5jcnQwCQYDVR0TBAIwADCCAQUGCisGAQQB1nkCBAIEgfYEgfMA
8QB2ALIeBcyLos2KIE6HZvkruYolIGdr2vpw57JJUy3vi5BeAAABaG9eTHsAAAQD
AEcwRQIgKUDoVrCW5gkmC196ffInmfoV6t0vQ+Ue9EfZ+e+IidUCIQC03XtAQMzg
tDlW1n2MPbdVjqRtDpnOW9rVgJx9M1uOcgB3AId1v+dZfPiMQ5lfvfNu/1aNR1Y2
/0q1YMG06v9eoIMPAAABaG9eTTUAAAQDAEgwRgIhAL5YulISvgf3uwXwrFKhTomC
HJa+FUhDxNjDKGDRhcqSAiEAp+Mb4qu4Fejh9GgphGn02B2HqndO0KFJvDjSvyfj
yBkwDQYJKoZIhvcNAQELBQADggEBAMfnhpeKWKV36+TuS+aTuzynr9qKQdnPhL2s
gjEo+NHK48Z/RYiVLf6Ua5Sq4rn9RTGqi7aQaoCcXwb90j3t5NONOMnw3PexbLfH
xr6qR0Z9ybJsLi326AVNfSMmbuy+RGqbHiNi9+y15yce+ozw+LK0eN3ZDvnuQPP2
CrwevWZhCuAGQ2PQc5rPilIbe/sE0C9Nf7wu78g7zowMRHf4TOsP/VZE/xC1MlIn
I9mm652488zO4WH3c7WnssEbUDqoGnIZ4v/3V3nckriEI+EM1ZNtguGYSAMeUsny
Odh738FbIJ1muWvwj3xCOOjSgrzRZ0EA1HhhO230ek/Zc7KEbD0=
-----END CERTIFICATE-----
subject=/CN=www.example.com
issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=RapidSSL RSA CA 2018
---
No client certificate CA names sent
---
SSL handshake has read 2433 bytes and written 456 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher : DHE-RSA-AES256-SHA
Session-ID: 5C2759394B4EC8B2F37EEF89ACBC01B5EF6B6F76CA809C6C2823BAD01AE368D5
Session-ID-ctx:
Master-Key: 6FE824F4F83B4205288D3DC23EE0FA0817A265FC818EDA37071A5DD21E088A74DD7DD19F69CB9A1A226BF43124CCD1FE
Key-Arg : None
Start Time: 1555058725
Timeout : 300 (sec)
Verify return code: 21 (unable to verify the first certificate)
---
read:errno=0
Most of the answers about "php curl - SSL certificate problem: unable to get local issuer certificate" says about configuring php curl settings in localhost / mamp and adding cacert.pem and ca-bundle.crt manually. But in my case this is not a problem with php curl in my localhost as I can access other sites over https.

Answer 1

The problem was solved when the existing Intermediate-CA certificate file was replaced wth the latest version. The issue was the existing Intermediate-CA certificate file being an outdated version.