Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using EC2 to host a PHP web service but I'm pretty sure the answer lies within the OpenSSL configuration so I'm asking here rather than on SO.

When connecting to a particular web service site I get this error from openssl:

error:14090086:SSL routines:func(144):reason(134)

Some googling seems to indicate that this means that for whatever reason it doesn't like the certificate that the site presents. Another service that I'm using works fine so I suspect that for some reason there's no trusted certificate for the service that's failing.

So two questions: How do I add a trusted CA to openssl? How do I get a certificate for the CA (GoDaddy)? Is it possible that something else is wrong? It seems weird to me that EC2 wouldn't support a GoDaddy certificate out of the box.

Edit I should also note that the exact same test script works on my local machine (MacBook Pro)

share|improve this question
    
Mozilla provides a package (which is available for most Linuxes) that has quite a selection of root certificates (in both CentOS and Ubuntu, the package is called ca-certificates). You can view the list of certificates here. For Amazon's Linux: yum install ca-certificates may help. –  cyberx86 May 21 '12 at 19:20
    
@cyberx86 - It's Amazon Linux, which is a derivative of RedHat so it's similar to CentOS. I see there is a ca-certificates package. Maybe I can solve the problem by finding a newer one. (The one I have claims to be the latest ...) –  Cfreak May 21 '12 at 19:22
    
@cyberx86 - Used a src RPM from Fedora. Rebuilt it for Amazon and it installed without issue. I know GoDaddy was included in it ... but still the same error :( –  Cfreak May 21 '12 at 19:36
    
Hmm, curl actually provides its own CA bundle and install script by the looks of it. It gets the same Mozilla bundle, but converts it to PEM format and makes it available to curl: curl.haxx.se/docs/caextract.html. I believe you follow this up by pointing curl to the bundle with curl_setopt($conn, CURLOPT_CAINFO, "/path/to/ca-bundle.crt"); –  cyberx86 May 21 '12 at 19:40
    
I'm not currently using curl, I'm using HTTP_Request2 which wraps stream_socket_connect in PHP. I think I can change it to use curl instead ... I'm still not 100% certain this is even the issue and there's not some other bizarre reason for this behavior. –  Cfreak May 21 '12 at 19:43
show 2 more comments

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.