SSL certificate for the host could not be verified

Question

I'm getting this error in a log file created by WooCommerce

"The SSL certificate for the host could not be verified."

The error is being generated by WordPress' file /wp-includes/class-http.php

http://hookr.io/3.8.2/classes/wp_http_streams/

I've tried setting the below in my functions file to disable SSL verification, but i'm still getting the error

add_filter( 'https_ssl_verify', '__return_false' );
add_filter( 'https_local_ssl_verify', '__return_false' );

On line 834 of class-http.php I tested changing this line

$connect_host = $secure_transport ? 'ssl://' . $connect_host : 'tcp://' . $connect_host;

To

$connect_host = $secure_transport ? 'sslv3://' . $connect_host : 'tcp://' . $connect_host;

The change is sslv3

I need this for connecting to authorize.net. Is there a filter I can use, to override the method in the class, if so which? I know enough to not modify core code, this was only for testing.

Thanks

Answer 1

I wouldn't recommend disabling ssl verification - that leaves your system vulnerable to potential man in the middle attacks as explained in this SO post. Also, your use of sslv3 is most likely causing this issue now SPECIFICALLY because Authorize.net identified it as vulnerable to the POODLE compromise.

Since that happened, many vendors removed the older authorize.net CA certificate bundles from their OpenSSL packages via updates.

The root cause of your problem appears to be that your application can't seem to locate where to find the updated bundle of root CA certificates and according to the above thread the original ones have been deprecated by Authorize.net:

According to the PHP Manual's openssl documentation on the cainfo parameter:

When calling a function that will verify a signature/certificate, the cainfo parameter is an array containing file and directory names that specify the locations of trusted CA files. If a directory is specified, then it must be a correctly formed hashed directory as the openssl command would use.

That would suggest you could download an updated bundle of CA certificates (or just get the specific one you need to connect to authorize.net.

Authorize.net's github project for their php-sdk includes an updated certificate collection that should resolve the issue you're seeing if you use the newly updated (as of 4 days ago) bundle.

It's not clear from your code samples if you're using their SDK already. If not, you should be able to just download that bundle and reference the path to the updated bundle per the extended examples using the cainfo parameter in whatever functions you use when you re-enable verification.

If so, you may want to update your composer.json to grab the latest version of the sdk.