Dealing with SSL Errors

Postmark-PHP utilizes a PHP extension called libcurl. Depending on various system settings, the default installation of libcurl can have issues verifying SSL/TLS certificates.

This results in error messages like the following:

cURL error 60: SSL certificate problem: unable to get local issuer certificate in...

Although it's not a problem specific to the Postmark library, we see it frequently enough that we wanted to share how to resolve it. This issue appears to happen more frequently on Windows, but the following instructions can be adapted to solve the issue on macOS and Linux.

OPTION 1 (Harder, but more secure):

Note that these instructions use windows directories, but the same process will work for linux installations by using linux-specific paths.

1. Download and save the CA bundle, to a location of your choice, perhaps c:\curl_ca_bundle.crt

2. In c:\windows, if there is not already a php.ini text file, create one.

3. Add or update the following lines to the php.ini:

   [PHP]
   curl.cainfo=c:\curl_ca_bundle.crt

4. Run your PHP scripts as normal.

This process will ensure you have the appropriate certificate chain needed to allow libcurl to verify the SSL/TLS certificates presented by the Postmark API, as well as many other Web Services.

OPTION 2 (Easier, but less secure):

After you require the Postmark library into your project, set the following global setting:

PostmarkClientBase::$VERIFY_SSL = false

This will still allow you to connect to the Postmark API using a TLS connection (which is encrypted), but it's possible that a Man-in-the-middle attack could impersonate the Postmark API, and this would go undetected by your client code.

When going this route, make sure to include an additional use statement for PostmarkClientBase:

use Postmark\PostmarkClientBase;

OPTION 3 (Not recommended):

After you require the Postmark library into your project, set the following global setting:

PostmarkClientBase::$BASE_URL = 'http://api.postmarkapp.com';

This is a last-resort option when you are using PHP in a system where SSL/TLS is not available. Your interactions with Postmark will be sent in plain-text and are at a much higher-risk of eavesdropping from 3rd parties. We do not recommend this solution, but some special circumstances may leave you with only this option.