SSL certificate problem: unable to get local issuer certificate

[diazwatson]

Has anyone faced this issue before?

Brand new Apple M3, first installation of Warden, first environment

[navarr]

I'm also on an M3, updated my images to pull everything - but I am not experiencing the same issue. Are you on a corporate intranet or VPN that might be man-in-the-middle'ing?

Composer version: 2.2.23
PHP version: 8.1.28
PHP binary path: /usr/bin/php
OpenSSL version: OpenSSL 3.0.7 1 Nov 2022
cURL version: 7.76.1 libz 1.2.11 ssl OpenSSL/3.2.1
zip: extension present, unzip present, 7-Zip not available

[diazwatson]

I am behind some sort of corporate intranet, but weirdly composer works just fine outside the container:

It is also fair to say that composer wasn't working initially (outside the container). It started working after I did this:

• Fetch latest root cert from https://curl.se/docs/caextract.html
• Run touch /private/etc/ssl/certs/newrootcert.crt
• Extract BigCorp Root CA file from Keychain
• Run cat BigCorp.pem >> newrootcert.crt
• Run cat cacert.pem >> newrootcert.crt where cacert.pem is the file downloaded in step 1
• Run composer config --global cafile /private/etc/ssl/certs/newrootcert.crt
• Run composer clearcache && composer diag to test

[navarr]

You'll likely have to do the same inside the image(s) you hope to get through the MITM. To make it persist, composer global config aside you can add that newrootcert into a .warden directory in your project and create a .warden/warden-env.yml file to mount it into the image during warden env up.

Something like:

services:
    php-fpm:
        volumes:
            - ./.warden/newrootcert.crt:/private/etc/ssl/certs/newrootcert.crt

[diazwatson]

@navarr if you ever visit Manchester UK, remember that you have a FREE beer in here!!!!