SSL routines:tls_process_server_certificate:certificate verify failed

Question

Since last night, several of my scripts (on different servers) using file_get_contents("https://...") and curl functions stopped working.
Example request that fails:

file_get_contents("https://domain.tld/script.php");

---

Error:

PHP Warning:  file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages:
error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed in /home/domain/public_html/script.php on line 19

I already "fixed" the problem using:

$arrContextOptions=array(
    "ssl"=>array(
       "verify_peer"=>false,
       "verify_peer_name"=>false,
    ),
); 

file_get_contents("https://domain.tld/path/script.php", false, stream_context_create($arrContextOptions));

The "fix" is far from ideal since I'm not verifying the authenticity of the connection, but until I understand the origin of the problem and how to prevent it from happening again, I'll be forced to use it.

---

Notes:

• PHP scripts with Curl also stopped working and the fix is similar: curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);;
• The SSL certificate is issued by Let's Encrypt and it was renewed last night ("not valid before 2020/12/24");
• All servers have the same timezone;
• I'm using CentOS 7/Ubuntu 18 and Virtualmin;
• If I open "https://domain.tld/script.php" on Firefox/Chrome, no SSL warnings are shown and the certificate is valid;
• I've tried to update the CA certificates (yum install ca-certificates.noarch), but the latest version is already installed;

---

I understand what's wrong, what I cannot figure out is why it started happening and how to fix it (the real fix).

---

Question:

How to fix and prevent it from happening again?

Answer 1

The problem was an outdated CA certificate and I found the solution on a Let's Encrypt community thread :

Manual Solution:

• Replace the contents of /home/[domain]/ssl.ca with lets-encrypt-r3-cross-signed.pem
• restart apache/nginx

Virtualmin Solution:

• Go to Virtualmin -> Server Configuration -> SSL Certificate -> CA Certificate

  • Option 1: Choose upload file and use lets-encrypt-r3-cross-signed.pem
  • Option 2: Paste the contents of lets-encrypt-r3-cross-signed.pem using the Pasted certificate text option.

• Press "Save Certificate"

---

Note:

This issue was fixed on webmin 1.970, so make sure you've the latest version installed, which wasn't my case due to the webmin repo not being enabled. If that's also your case, just enable or add the webmin repo and run yum update.