Question

I’ve noticed a little problem with CURL in PHP. Whenever I request a https:// connection it returns “false”, and every website that I try to reach while I have my PHP page open reports to have an Untrusted certificate.

This is my request method:

private function request($url, $params, $method = "GET") {
        if ($method == "GET")
            $url = $this->structGET($url, $params);
        $ch = curl_init($url);
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        if (isset($_SERVER['HTTP_USER_AGENT'])) {
            curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);
        } else {
            curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.X.Y.Z Safari/525.13.');
        }
        curl_setopt($ch, CURLOPT_TIMEOUT, 30);

        $header[] = 'Accept-Language: EN';
        curl_setopt($ch, CURLOPT_HTTPHEADER, $header);
        if ($method == "POST") {
            curl_setopt($ch, CURLOPT_POST, true);
            if ($params)
                curl_setopt($ch, CURLOPT_POSTFIELDS, $params);
        }
        $result = curl_exec($ch);
        curl_close($ch);
        return $result;
    }

And this is what Chrome returns when I try visiting Facebook.

The site’s security certificate is not trusted!

You attempted to reach
http://www.facebook.com, but the server presented a certificate issued by an
entity that is not trusted by your computer’s operating system. This
may mean that the server has generated its own security credentials,
which Google Chrome cannot rely on for identity information, or an
attacker may be trying to intercept your communications. You cannot
proceed because the website operator has requested heightened security
for this domain.

Answer 1

Yeah that happens when cURL tries to see if the SSL is verified. Facebook usually has a verified signature but may be because of network, it is returning invalid (happens in my case: using fortiguard proxy, facebook blocked!)

So, what you can do is, you can choose to ignore that error totally.

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);

That should fix it. But, if you want to fix it properly, then you should probably use a proxy or something or get a certificate for the server(if it is yours).