SSL Certificate Verification issue when posting to secure hosts

[mresults]

Problem manifests itself via a combination of factors:

• Site is hosted externally:

  • An environment where the system's php.ini file is not modifiable.
  • Host's cURL CAINFO either isn't present or leads to an outdated certificates file

• Request is made to a 3rd party via SSL (ie. https).

The specific error returned is:

SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

Typically we would fix this by updating the server's SSL CA info file, however on an externally hosted server this is not possible.

Wordpress' _WPHttp class seems to support specifying a custom CA info file when the request method is called:

'sslcertificates' => ABSPATH . WPINC . '/certificates/ca-bundle.crt',

Not sure if Wordpress' file is out of date?

In any case - is there a way to, preferably via the theme's functions.php file, add a hook to set the CA info file path so that the 3rd Party plugin (and other plugins using the http class) use an updated file for SSL verification?

[zaus]

This sounds like http://drzaus.com/plugins/forms-3rdparty#comment-2458 -- I think what you were suggesting is to specify 'sslverify' => false in the wp_remote_post args.

You can do this via the hook at line 415 of the main plugin code, which is described as Forms3rdPartyIntegration_service_filter_args, #5 of the hooks section in the readme. You can write this hook in your functions.php file (or anywhere normally referenced, really), something like:

add_filter('Forms3rdPartyIntegration_service_filter_args', 'forms3rdparty_sslverify_override', 10, 3);
function forms3rdparty_sslverify_override($args, $service, $form) {
    $args['sslverify'] = false;
    return $args;
}

[zaus]

@mresults any luck?

[zaus]

Closing, no activity