Website on Plesk shows: cURL error (77): Problem with the SSL CA cert

kb: technical Plesk Obsidian for Linux Plesk Obsidian for Windows

Applicable to:

A website or PHP scripts show the following error:

CONFIG_TEXT: cURL error (77): Problem with the SSL CA cert (path access rights)cURL error (77): Problem with the SSL CA cert (path access rights)

CONFIG_TEXT: Error : "error setting certificate verify locations: CAfile: C:\Program Files (x86)\Plesk\Additional\PHPSettings\cacert.pem CApath: none"

CONFIG_TEXT: cURL error 77: error setting certificate verify locations: CAfile: /etc/ssl/certs/cacert.pem CApath: /etc/ssl/certs
On Plesk for Windows the Extensions menu may show the following error when trying to open it:

PLESK_ERROR: error setting certificate verify locations: CAfile: C:\Program Files (x86)\Plesk\admin\conf\cacert.pem CApath: none

PHP cURL uses an outdated set of root certificates to verify server certificates.

Solution 1 - Using Plesk GUI

Log in to Plesk.
Install Panel.ini Editor extension: Extensions > Server Tools section > Panel.ini Editor.
Go to Extensions > My Extensions > Panel.ini Editor (Go To Extension) > Editor.
Add records below to the editor and Save changes:

CONFIG_TEXT: [php]
curlCertificatesUrl="http://curl.haxx.se/ca/cacert.pem"
Wait until Daily task is executed (It is executed once a day).
Go to Domains > example.com > PHP Settings and add the line below into Additional configuration directives. Replace path to cacert.pem with your own path.

CONFIG_TEXT: curl.cainfo="C:\Program Files (x86)\Plesk\Additional\PHPSettings\cacert.pem"

If it is required to apply the changes for all the domains using a particular PHP version go to Tools & Settings > PHP Settings> %PHP_version%, click on php.ini tab and add the following line at the end of file:

CONFIG_TEXT: curl.cainfo="/etc/ssl/certs/cacert.pem"

Solution 2 for Windows

Log in to the server via RDP.
Download the cacert.pem file from the main curl website http://curl.haxx.se/ca/cacert.pem.
Open %plesk_dir%admin\conf\panel.ini file (create it from panel.ini.sample if it doesn't exist)

Note: %plesk_dir% by default is C:\Program Files (x86)\Plesk\
Add below directive to panel.ini.

CONFIG_TEXT: [php]
curlCertificatesUrl="http://curl.haxx.se/ca/cacert.pem
Place downloaded cacert.pem to %plesk_dir%Additional\PHPSettings\ directory.
Wait until Daily task is executed (It is executed once a day).

Solution 2 for Linux

Connect to the server via SSH
Download the CA certificate store from the official cURL website and move it to the directory /etc/ssl/certs/:

# wget https://curl.haxx.se/ca/cacert.pem && mv cacert.pem /etc/ssl/certs/
Log into Plesk.
Go to Tools & Settings > PHP Settings > %PHP version% > php.ini.
Add the following line into the end of the file:

CONFIG_TEXT: curl.cainfo="/etc/ssl/certs/cacert.pem"
Click OK to save the file