When doing a composer update on my Laminas projects with composer (on a Windows Machine with PHP 8.3 and Apache 2.4) out of the blue this error appeared 2 days ago (before that I used it with success):

curl error 60 while downloading .json: SSL certificate problem: unable to get local issuer certificate

What I tried (without success):

1. Disabling Anti Virus (caveat: see answer)
2. Downloading latest cacert.pem and changed php.ini to the location with the certificate (curl.cainfo and openssl.cafile).
3. Update composer version (I had to change "disable-tls": false in composer config.json and then it worked)
4. Removed latest windows update
5. composer self-update --update-keys

I'm running out of options and I am googling for 2 days now and tried a lot, but was unable to find a solution for this problem.

composer diagnose

Checking composer.json: OK
Checking platform settings: OK
Checking git settings: No git process found
Checking http connectivity to packagist: OK
Checking https connectivity to packagist: FAIL
[Composer\Downloader\TransportException] curl error 60 while downloading .json: SSL certificate problem: unable to get local issuer certificate
Checking github rate limit: FAIL
[Composer\Downloader\TransportException] curl error 60 while downloading : SSL certificate problem: unable to get local issuer certificate
Checking disk free space: OK
Checking pubkeys:
Tags Public Key Fingerprint: ***
Dev Public Key Fingerprint: ***
OK
Checking Composer version: FAIL
[Composer\Downloader\TransportException] curl error 60 while downloading : SSL certificate problem: unable to get local issuer certificate
Checking Composer and its dependencies for vulnerabilities: Failed performing audit: curl error 60 while downloading .json: SSL certificate problem: unable to get local issuer certificate
Composer version: 2.8.5
PHP version: 8.3.17
PHP binary path: C:\PHP\php.exe
OpenSSL version: OpenSSL 3.0.15 3 Sep 2024
curl version: 8.7.0-DEV libz 1.2.12 ssl OpenSSL/3.0.15
zip: extension present, unzip not available, 7-Zip not available

Procedure to download cacert.pem

1. Go to .html
2. Downloaded cacert.pem
3. uploaded it to cert location of composers config.php
4. To check the hash i added this line to some PHP file: echo hash_file('sha256', 'example.txt', false);

• That hash does not match the hash in the downloaded certificate or the "Here's the sha256sum of the current PEM file" link

HASH in downloaded cacert.pem -> SHA256: ***d3aca3c05c566d8dc98e116

HASH in PHP file -> ***b934ca495991b7852b855

HASH when using link .pem.sha256 -> ***90425d7da901a11531b3aa5

When doing a composer update on my Laminas projects with composer (on a Windows Machine with PHP 8.3 and Apache 2.4) out of the blue this error appeared 2 days ago (before that I used it with success):

curl error 60 while downloading https://repo.packagist./packages.json: SSL certificate problem: unable to get local issuer certificate

What I tried (without success):

1. Disabling Anti Virus (caveat: see answer)
2. Downloading latest cacert.pem and changed php.ini to the location with the certificate (curl.cainfo and openssl.cafile).
3. Update composer version (I had to change "disable-tls": false in composer config.json and then it worked)
4. Removed latest windows update
5. composer self-update --update-keys

I'm running out of options and I am googling for 2 days now and tried a lot, but was unable to find a solution for this problem.

composer diagnose

Checking composer.json: OK
Checking platform settings: OK
Checking git settings: No git process found
Checking http connectivity to packagist: OK
Checking https connectivity to packagist: FAIL
[Composer\Downloader\TransportException] curl error 60 while downloading https://repo.packagist./packages.json: SSL certificate problem: unable to get local issuer certificate
Checking github rate limit: FAIL
[Composer\Downloader\TransportException] curl error 60 while downloading https://api.github/rate_limit: SSL certificate problem: unable to get local issuer certificate
Checking disk free space: OK
Checking pubkeys:
Tags Public Key Fingerprint: ***
Dev Public Key Fingerprint: ***
OK
Checking Composer version: FAIL
[Composer\Downloader\TransportException] curl error 60 while downloading https://getcomposer./versions: SSL certificate problem: unable to get local issuer certificate
Checking Composer and its dependencies for vulnerabilities: Failed performing audit: curl error 60 while downloading https://repo.packagist./packages.json: SSL certificate problem: unable to get local issuer certificate
Composer version: 2.8.5
PHP version: 8.3.17
PHP binary path: C:\PHP\php.exe
OpenSSL version: OpenSSL 3.0.15 3 Sep 2024
curl version: 8.7.0-DEV libz 1.2.12 ssl OpenSSL/3.0.15
zip: extension present, unzip not available, 7-Zip not available

Procedure to download cacert.pem

1. Go to https://curl.se/docs/caextract.html
2. Downloaded cacert.pem
3. uploaded it to cert location of composers config.php
4. To check the hash i added this line to some PHP file: echo hash_file('sha256', 'example.txt', false);

• That hash does not match the hash in the downloaded certificate or the "Here's the sha256sum of the current PEM file" link

HASH in downloaded cacert.pem -> SHA256: ***d3aca3c05c566d8dc98e116

HASH in PHP file -> ***b934ca495991b7852b855

HASH when using link https://curl.se/ca/cacert.pem.sha256 -> ***90425d7da901a11531b3aa5

• php
• ssl
• curl

• Composer has trouble-shooting guidelines on their homepage, I'd suggest you do the general first five always first: getcomposer./doc/articles/troubleshooting.md#general . Additionally please edit your question and put in the command and it's output verbatim: composer diagnose. – hakre Commented Feb 15 at 16:04
• Also did that (added), no extra info (i think) – Jilco Tigchelaar Commented Feb 15 at 16:16
• 1 Well, assuming the common error, it shows that updating the CA certificates may not have worked. I write may because you have not documented in your question how you did that, so it is a bit of guess. However the error code / message is clear (60), ref: curl.se/libcurl/c/… and you find the curl related download+info here with infos for differences on windows: curl.se/docs/caextract.html -- I'd double-check that. When you run composer diagnose -vvv composer may also show location of cert paths, which can be helpful for you. – hakre Commented Feb 15 at 16:29
• When doing that the ca file is valid (Checked CA file C:\Program Files\Common Files\SSL\cert.pem: valid) – Jilco Tigchelaar Commented Feb 15 at 17:21
• Maybe this is interesting: Failed to initialize global composer: Composer could not find the config file: C:/Users/jilco/AppData/Roaming/Composer/composer.json – Jilco Tigchelaar Commented Feb 15 at 17:22

1 Answer 1

I am using Norton Antivirus, and I disabled the "HTTPS Scanning" option within the "Safe Web" feature as outlined in All HTTPS connections outside of browser fail with "SSL certificate problem: unable to get local issuer certificate"

This prevented the curl error 60 in composer.

For reference: https://curl.se/libcurl/c/libcurl-errors.html#CURLEPEERFAILEDVERIFICATION

CURLE_PEER_FAILED_VERIFICATION (60)

The remote server's SSL certificate or SSH fingerprint was deemed not OK.