topic Re: SSL Certificate Problem (Another Authorize.net Outage) in Integration and Testing

SSL Certificate Problem (Another Authorize.net Outage)

danlagi32 — Thu, 22 Mar 2018 14:57:35 GMT

THIS PROBLEM HAS RETURNED!

CURL ERROR: SSL certificate problem: unable to get local issuer certificate

Yesterday, working in the sandbox was fine (I've been working fine all week long), then this morning I started testing again, and first thing I get is this message!

I've done a quick search and found a couple of articles referencing this back in 2015, but it was supposedly solved.

Is anybody else having this problem? How did you fix it? BTW, I have not changed anything on my system since yesterday when it was working fine.

Regards,

Dan Luevano

Re: SSL Certificate Problem (Another Authorize.net Outage)

cwilsontv — Thu, 22 Mar 2018 16:00:26 GMT

<?xml version="1.0" encoding="UTF-8"?>
<getCustomerProfileIdsRequest xmlns="AnetApi/xml/v1/schema/AnetApiSchema.xsd">
  <merchantAuthentication>
    <name><![CDATA[xxxx]]></name>
    <transactionKey>xxxx</transactionKey>
  </merchantAuthentication>
  <clientId><![CDATA[sdk-php-1.9.5]]></clientId>
</getCustomerProfileIdsRequest>

Thu, 22 Mar 2018 11:55:13 -0400 ERROR : [_sendRequest] (C:\nginx\html\vendor\authorizenet\authorizenet\lib\net\authorize\util\HttpClient.php : 106) - CURL ERROR: SSL certificate problem: unable to get local issuer certificate

But in postman:

https://apitest.authorize.net/xml/v1/request.api

<?xml version="1.0" encoding="UTF-8"?>
<getCustomerProfileIdsRequest xmlns="AnetApi/xml/v1/schema/AnetApiSchema.xsd">
  <merchantAuthentication>
    <name><![CDATA[xxxx]]></name>
    <transactionKey><![CDATA[xxxx]]></transactionKey>
  </merchantAuthentication>
  <clientId><![CDATA[sdk-php-1.9.5]]></clientId>
</getCustomerProfileIdsRequest>

Response:

<?xml version="1.0" encoding="utf-8"?>
<getCustomerProfileIdsResponse xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="AnetApi/xml/v1/schema/AnetApiSchema.xsd">
    <messages>
        <resultCode>Ok</resultCode>
        <message>
            <code>I00001</code>
            <text>Successful.</text>
        </message>

...

So seems specific to CURL validating the SSL peer, but only on the sandbox.

Was also working fine all week for me as well.

Re: SSL Certificate Problem (Another Authorize.net Outage)

danlagi32 — Thu, 22 Mar 2018 16:47:15 GMT

Please don't take this the wrong way, but I'm glad I'm not the only one having a problem. :-)

Re: SSL Certificate Problem (Another Authorize.net Outage)

cwilsontv — Thu, 22 Mar 2018 17:29:46 GMT

Same.

If I didn't see your post I'd still be digging through everything trying to figureout what I did between yesterday and today.

Re: SSL Certificate Problem (Another Authorize.net Outage)

Optimal1 — Thu, 22 Mar 2018 18:31:22 GMT

Same problem here. Sandbox was working great this morning and then all the sudden, I'm receiving the SSL error.

Re: SSL Certificate Problem (Another Authorize.net Outage)

danlagi32 — Thu, 22 Mar 2018 19:06:57 GMT

BTW, I've sent in a detailed email to developer@authorize.net as suggested by someone from live chat.

I'll post when they come up with a resolution.

Re: SSL Certificate Problem (Another Authorize.net Outage)

mvb89b — Thu, 22 Mar 2018 19:29:30 GMT

I am having the exact same problem and it was working this morning. Let us know what you find out.

Re: SSL Certificate Problem (Another Authorize.net Outage)

CodeDawg — Thu, 22 Mar 2018 21:33:38 GMT

Same here. Anyone know what the estimated repair time is?

Re: SSL Certificate Problem (Another Authorize.net Outage)

danlagi32 — Thu, 22 Mar 2018 21:44:58 GMT

No word yet. I just got the standard email reply when I sent in my request.

BTW, here is the email I sent in so you can compare your log files:

------------------- SNIP -------------------------

Support,

Starting this morning I have not been able to connect via CURL to SSL. I get the following error: CURL ERROR: SSL certificate problem: unable to get local issuer certificate. I posted this on the forum here: https://community.developer.authorize.net/t5/Integration-and-Testing/SSL-Certificate-Problem-Another-Authorize-net-Outage/m-p/62251#M36610 and someone else said they're experiencing the same problem. I tried connecting to the PRODUCTION site and all works okay. It's just the SANDBOX that is not working. I was able to use the SANDBOX all week long with no issues. This problem just started happening this morning when I first got in.

See output from phplog and error_log files below.

Here is an excerpt from the phplog file:

Thu, 22 Mar 2018 10:59:29 -0600 INFO : [execute] (/home/www/public_html/catalog/vendor/authorizenet/authorizenet/lib/net/authorize/api/controller/base/ApiOperationBase.php : 114) - Request Serialization Begin

Thu, 22 Mar 2018 10:59:29 -0600 DEBUG : [execute] (/home/www/public_html/catalog/vendor/authorizenet/authorizenet/lib/net/authorize/api/controller/base/ApiOperationBase.php : 115) - net\authorize\api\contract\v1\GetCustomerProfileRequest Object

(

    [customerProfileId:net\authorize\api\contract\v1\GetCustomerProfileRequest:private] => 1XXXXXXXX9

    [merchantCustomerId:net\authorize\api\contract\v1\GetCustomerProfileRequest:private] =>

    [email:net\authorize\api\contract\v1\GetCustomerProfileRequest:private] =>

    [unmaskExpirationDate:net\authorize\api\contract\v1\GetCustomerProfileRequest:private] =>

    [includeIssuerInfo:net\authorize\api\contract\v1\GetCustomerProfileRequest:private] =>

    [merchantAuthentication:net\authorize\api\contract\v1\ANetApiRequestType:private] => net\authorize\api\contract\v1\MerchantAuthenticationType Object

        (

            [name:net\authorize\api\contract\v1\MerchantAuthenticationType:private] => 4XXXXXXXX8

            [transactionKey:net\authorize\api\contract\v1\MerchantAuthenticationType:private] => xxxx

            [sessionToken:net\authorize\api\contract\v1\MerchantAuthenticationType:private] =>

            [password:net\authorize\api\contract\v1\MerchantAuthenticationType:private] =>

            [impersonationAuthentication:net\authorize\api\contract\v1\MerchantAuthenticationType:private] =>

            [fingerPrint:net\authorize\api\contract\v1\MerchantAuthenticationType:private] =>

            [clientKey:net\authorize\api\contract\v1\MerchantAuthenticationType:private] =>

            [accessToken:net\authorize\api\contract\v1\MerchantAuthenticationType:private] =>

            [mobileDeviceId:net\authorize\api\contract\v1\MerchantAuthenticationType:private] =>

        )

 

    [clientId:net\authorize\api\contract\v1\ANetApiRequestType:private] => sdk-php-1.9.5

    [refId:net\authorize\api\contract\v1\ANetApiRequestType:private] => ref1XXXXXXXX9

)

 

Thu, 22 Mar 2018 10:59:29 -0600 INFO : [execute] (/home/www/public_html/catalog/vendor/authorizenet/authorizenet/lib/net/authorize/api/controller/base/ApiOperationBase.php : 118) - Request  Serialization End

Thu, 22 Mar 2018 10:59:29 -0600 INFO : [_sendRequest] (/home/www/public_html/catalog/vendor/authorizenet/authorizenet/lib/net/authorize/util/HttpClient.php : 75) -  Url: https://apitest.authorize.net/xml/v1/request.api

Thu, 22 Mar 2018 10:59:29 -0600 INFO : [_sendRequest] (/home/www/public_html/catalog/vendor/authorizenet/authorizenet/lib/net/authorize/util/HttpClient.php : 77) - Request to AnetApi:

<?xml version="1.0" encoding="UTF-8"?>

<getCustomerProfileRequest xmlns="AnetApi/xml/v1/schema/AnetApiSchema.xsd">

  <merchantAuthentication>

    <name><![CDATA[4XXXXXXXX8]]></name>

    <transactionKey>xxxx</transactionKey>

  </merchantAuthentication>

  <clientId><![CDATA[sdk-php-1.9.5]]></clientId>

  <refId><![CDATA[ref1XXXXXXXX9]]></refId>

  <customerProfileId><![CDATA[1XXXXXXXX9]]></customerProfileId>

</getCustomerProfileRequest>

 

Thu, 22 Mar 2018 10:59:29 -0600 INFO : [_sendRequest] (/home/www/public_html/catalog/vendor/authorizenet/authorizenet/lib/net/authorize/util/HttpClient.php : 89) - Sending 'XML' Request type

Thu, 22 Mar 2018 10:59:29 -0600 INFO : [_sendRequest] (/home/www/public_html/catalog/vendor/authorizenet/authorizenet/lib/net/authorize/util/HttpClient.php : 94) - Sending http request via Curl

Thu, 22 Mar 2018 10:59:29 -0600 INFO : [_sendRequest] (/home/www/public_html/catalog/vendor/authorizenet/authorizenet/lib/net/authorize/util/HttpClient.php : 96) - Response from AnetApi:

 Thu, 22 Mar 2018 10:59:29 -0600 ERROR : [_sendRequest] (/home/www/public_html/catalog/vendor/authorizenet/authorizenet/lib/net/authorize/util/HttpClient.php : 106) - CURL ERROR: SSL certificate problem: unable to get local issuer certificate

Here is an exerpt from the error_log file:

[22-Mar-2018 10:59:29 America/Denver] PHP Fatal error:  Uncaught exception 'Exception' with message 'Error getting valid response from api. Check log file for error details' in /home/www/public_html/catalog/vendor/authorizenet/authorizenet/lib/net/authorize/api/controller/base/ApiOperationBase.php:126

Stack trace:

#0 /home/www/public_html/catalog/vendor/authorizenet/authorizenet/lib/net/authorize/api/controller/base/ApiOperationBase.php(104): net\authorize\api\controller\base\ApiOperationBase->execute('https://apitest...')

#1 /home/www/public_html/catalog/vendor/authorizenet/authorizenet/lib/anetFunctions.php(594): net\authorize\api\controller\base\ApiOperationBase->executeWithApiResponse('https://apitest...')

#2 /home/www/public_html/catalog/includes/classes/cimInfo.php(325): anet_GetCustomerProfile('1XXXXXXXX9', true)

#3 /home/www/public_html/catalog/includes/classes/cimInfo.php(54): cimInfo->getPaymentProfile()

#4 /home/www/public_html/catalog/checkout_confirmation.php(67): cimInfo->__construct('1XXXXXXXX9:1503...', '', 'get')

#5 {main}

  thrown in /home/www/public_html/catalog/vendor/authorizenet/authorizenet/lib/net/authorize/api/controller/base/ApiOperationBase.php on line 126

Re: SSL Certificate Problem (Another Authorize.net Outage)

nbansal — Thu, 22 Mar 2018 22:40:21 GMT

Looks like the issue could be with the root certificates on the system you are trying to connect from.

Can you try updating the cacert.pem on your system and give a try, as discussed here.

Re: SSL Certificate Problem (Another Authorize.net Outage)

CodeDawg — Thu, 22 Mar 2018 23:33:41 GMT

Didn't work for me. Win7/XAMPP v3.2.2.

Re: SSL Certificate Problem (Another Authorize.net Outage)

tserface — Fri, 23 Mar 2018 00:08:15 GMT

The sandbox was working for me until this morning. I checked the certs and they are all still good for years to come. It also broke on all of my 4 severs at the same time without any updates. And, it seems to have broken for lots of other people here all at the same time. I can use it if I disable SSL for curl, but this means directly modifying the API and, bigger issue, no security for transactions. At least I can keep testing, but it would be nice to hear from Authorize.Net about what to do about this sudden issue.

Re: SSL Certificate Problem (Another Authorize.net Outage)

robin_cte — Fri, 23 Mar 2018 11:11:33 GMT

Well I was hoping this would be fixed this morning. Like everyone, I was cruising along fine until the suddenly stopped working yesterday. Small mod to the api got it working for now.

HttpClient.php , line 80, comment out:

curl_setopt($curl_request, CURLOPT_CAINFO, dirname(dirname(__FILE__)) . '/../../ssl/cert.pem');

This is NOT SECURE, not a permanent solution. I'm just testing so it lets me continue working.

So that cert is in a weird place, not sure where it came from. Was it part of the api install? I'm not cert savvy so I've got to wait for our sys admin to wake up and look at it.

Re: SSL Certificate Problem (Another Authorize.net Outage)

robin_cte — Fri, 23 Mar 2018 12:14:59 GMT

OK, following a post on this thread:
https://community.developer.authorize.net/t5/The-Authorize-Net-Developer-Blog/Authorize-Net-Begins-Infrastructure-and-SHA-2-Certificate/bc-p/50166#M445

I replaced cert.pem with the file from

http://curl.haxx.se/ca/cacert.pem

and all seems well

Re: SSL Certificate Problem (Another Authorize.net Outage)

nibarra — Fri, 23 Mar 2018 12:41:37 GMT

This worked for me. Thanks!!!!!

Re: SSL Certificate Problem (Another Authorize.net Outage)

danlagi32 — Fri, 23 Mar 2018 13:05:57 GMT

Replacing the cert.pem also worked for me. Is this a solution or a patch/work-around?

Re: SSL Certificate Problem (Another Authorize.net Outage)

cwilsontv — Fri, 23 Mar 2018 14:21:44 GMT

Just to be clear about what's going on:

apitest.authorize.net updated their SSL as of March 20th. (you can verify in browser by going there and checking).

Curl can be configured to validate the SSL of the host it is connecting to before transfering data (which it should be).

Curl can also be configured to use a specific CA (https://support.dnsimple.com/articles/what-is-ssl-certificate-chain/) to validate the SSL. This is why it looks at that pem. This is handy if you're using self signed certs or something like that, where your local machine doesn't have or know the CA to use to validate the SSL.
The new SSL that the sandbox switched to doesn't validate with the CA that is provided by the library anymore. So now we get this error.
Changing the pem to the one linked at http://curl.haxx.se/ca/cacert.pem works because that one has a CA that will validate the new sandbox SSL.
As someone else suggested, you can also comment out line 80 of HttpClient.php. This line is telling curl to use that specific pem's CA to validate the host in the SSL request. This is not as insecure as someone stated because when you remove this setting CURL can default to it's own CA bundle, the system store, or other trusted stores depending on how it's built. It is still less secure, but it's not completely disregarding SSL validation. Eitherway on my windows test machine commenting it out doesn't work anyway.
If using http://curl.haxx.se/ca/cacert.pem then besure to double check it works with production if your deployment process would push it, as unless someone tests it and verifies, there's no way to know if that CA will validate the production endpoint.
I would consider this a temporary work around because if you're using https://github.com/AuthorizeNet/sdk-php (and why wouldn't you be?) redeploying that lib would wipe out the pem (and thus my integration tests are broken), so until it's updated it's no good for the sandbox.
That github repo needs to update the pem like they did in 2015, but the best long term soultion would also be to provide us with a configurable path to the pem, so we can substitiue ones when needed, and also for when dev and production are different. I opened an issue: https://github.com/AuthorizeNet/sdk-php/issues/298

Re: SSL Certificate Problem (Another Authorize.net Outage)

danlagi32 — Fri, 23 Mar 2018 14:25:17 GMT

Thank you very much for your explanation! This is helpful. Now I know to also check the production side when I'm ready to go LIVE, and I'll know what to do if I encounter a problem.

Much appreciated!

Best Regards,

Dan Luevano

Re: SSL Certificate Problem (Another Authorize.net Outage)

tserface — Fri, 23 Mar 2018 14:30:39 GMT

I'll chime in and say this worked for me as well. I had to modify one of the files in the API because I couldn't find a way to set the cert path with a function (it's hardcoded), but this made it work. Is this the solution? Do we know why the other stopped working. According to the date in the file it should have worked until May 2022 for the one I have.

I'm happy to have a fix, but it would be interesting to know why it broke suddenly for so many people.

Tom

Re: SSL Certificate Problem (Another Authorize.net Outage)

nonrandom — Fri, 23 Mar 2018 14:44:17 GMT

Had the same issue this morning but fixed it by replacing the /lib/ssl/cert.pem with the one from http://curl.haxx.se/ca/cacert.pem

Thanks for all the tips and information in this thread!