SSL certificate for the host could not be verified

I wouldn’t recommend disabling ssl verification – that leaves your system vulnerable to potential man in the middle attacks as explained in this SO post. Also, your use of sslv3 is most likely causing this issue now SPECIFICALLY because Authorize.net identified it as vulnerable to the POODLE compromise.

Since that happened, many vendors removed the older authorize.net CA certificate bundles from their OpenSSL packages via updates.

The root cause of your problem appears to be that your application can’t seem to locate where to find the updated bundle of root CA certificates and according to the above thread the original ones have been deprecated by Authorize.net:

According to the PHP Manual’s openssl documentation on the cainfo parameter:

When calling a function that will verify a signature/certificate, the
cainfo parameter is an array containing file and directory names that
specify the locations of trusted CA files. If a directory is
specified, then it must be a correctly formed hashed directory as the
openssl command would use.

That would suggest you could download an updated bundle of CA certificates (or just get the specific one you need to connect to authorize.net.

Authorize.net’s github project for their php-sdk includes an updated certificate collection that should resolve the issue you’re seeing if you use the newly updated (as of 4 days ago) bundle.

It’s not clear from your code samples if you’re using their SDK already. If not, you should be able to just download that bundle and reference the path to the updated bundle per the extended examples using the cainfo parameter in whatever functions you use when you re-enable verification.

If so, you may want to update your composer.json to grab the latest version of the sdk.

Leave a Comment