在“https://s3-us-west-2.amazonaws.com/上执行”ListBuckets“时出错：出现此错误的原因是什么？

Question

While I am trying to list buckets I get the following php error:

( ! ) Fatal error: Uncaught exception 'Aws\S3\Exception\S3Exception' with message 
'Error executing "ListBuckets" on "https://s3-us-west-2.amazonaws.com/";
AWS HTTP error: cURL error 60: SSL certificate problem: unable to get 
local issuer certificate (see http://curl.haxx.se/libcurl/c/libcurl-errors.html)' in 
C:\wamp\www\Web_Projects\aws\Aws\WrappedHttpHandler.php on line 159

( ! ) Aws\S3\Exception\S3Exception: Error executing "ListBuckets" on 
"https://s3-us-west-2.amazonaws.com/"; AWS HTTP error: cURL error 60: SSL 
certificate problem: unable to get local issuer certificate (see 
http://curl.haxx.se/libcurl/c/libcurl-errors.html) in 
C:\wamp\www\Web_Projects\aws\Aws\WrappedHttpHandler.php on line 159
Call Stack

Code with which I am trying:

<?php
    error_reporting(1);

    require 'aws-autoloader.php';
    use Aws\S3\S3Client;


    $options = [
        'region'            => 'us-west-2',
        'version'           => 'latest',
        'credentials' => [
            'key'    => 'AKXXXXXXLPPHXXXXXXXXXPA',
            'secret' => 'a/b/c+d',
        ]
    ];

    $s3Client = new S3Client($options);
    $s3Client->listBuckets();

?>

What could be the reason I am getting the above error?

Answer 1

Those errors refers to a problem locating the issuing Root intermediate CA in your local keystore:

AWS HTTP error: cURL error 60: SSL certificate problem: unable to get 
local issuer certificate

As show in libcurl Error Codes, error 60 is:

CURLE_SSL_CACERT (60) Peer certificate cannot be authenticated with known CA certificates.

Try this: Use the command line version of CURL to connect to the HTTPS url you are referring to:

curl https://www.example.com

You should see the following message:

>curl  https://www.example.com
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

Follow the instructions provided above and in Details on Server SSL Certificates. Also run the Qualsys SSL Server Test to help analyze any possible issues.

After confirming and fixing via the command line, re-run the code. It should run correctly.