Fix for WSL Ubuntu: Error 60 with cURL and Composer

[its-leoeff511]

I wanted to share this for those of you behind a firewall/vpn, that you can't easily disable and in my case Zscaler on Windows using WSL Ubuntu. I was receiving "curl error 60" when running bin/start and bin/composer update. I had help from issue #930 but wasn't able to get it to work for me due to a few minor steps.

If you are using WSL for the first time you may also need to perform similar steps for your Ubuntu host so its about 3 levels of configuration. Key point is that I believe bin/start error is running as a OS level cURL command and bin/composer update is running the curl extension through PHP.

No other steps of downloading a pem from https://curl.se/docs/caextract.html works. It has to be the certificate generated from Zscaler, one other reminder is that the .cer file generated in the following steps is under the hood a .pem file. So it should be named cacert.pem to match default configurations of the OS level cURL. For PHP cURL at a later step it should be named cert.pem.

The Levels:

1. WSL: Ubuntu OS cURL
2. Container: OS level cURL
3. Container: PHP cURL extension

Errors returned when running bin/start or to test bin/root curl -v https://www.google.com

In CurlDownloader.php line 372:
  curl error 60 while downloading https://repo.packagist.org/packages.json: SSL
  certificate problem: unable to get local issuer certificate

curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

Error returned when running bin/composer update

Loading composer repositories with package information

In CurlDownloader.php line 372:

  curl error 60 while downloading https://repo.magento.com/packages.json: SSL ce
  rtificate problem: unable to get local issuer certificate

The Steps

Generating .cer from Zscaler

These are the steps for Windows users to generate the .cer from Zscaler, slightly modified from this Stack Overflow

1. Open the certificate manager (Start > Run > certlm.msc)
2. Find the certificate in the Trusted Root Certification Authorities\Certificates folder. Should be named Zscalar Root CA.
3. Right click it, then choose All Tasks > Export...
4. Click Next
5. Select the Base-64 encoded X.509 (.CER) option
6. Save the file to your Ubuntu location like `\\wsl.localhost\Ubuntu` in my case i put it in `\\wsl.localhost\Ubuntu\home\<username>\<yourMarkShustDockerLocation>\src`

Make sure the file name is cacert.pem

Step 1

Copy it over from \src to container

Below command places it in the containers /var/www/html location, it also sets ownership and permissions for you.

• bin/copytocontainer cacert.pem

Step 2: For Container OS Level cURL:

• Copy it from /var/www/html to /etc/ssl/certs/ with bin/root cp /var/www/html/cacert.pem /etc/ssl/certs/

• For sanity check: bin/root ls /etc/ssl/certs

Step 3: For Container PHP cURL:

• Copy it with: bin/root cp /etc/ssl/certs/cacert.pem /usr/lib/ssl/cert.pem

  • Note that the last command renamed the cert, since by default php.ini is configured to look for cert.pem inside of /usr/lib/ssl

Step 4: Now test

• Curl command bin/root curl -v https://www.google.com. NO MORE ERROR just a bunch of source code!

• composer with bin/composer update. NO MORE ERROR!

That's it now go develop stuff.

Reference:

Os Level cURL cert location: /etc/ssl/certs/cacert.pem

PHP level cert location: /usr/lib/ssl/cert.pem

Additional Notes:

You may need to run these commands in your WSL:

sudo apt-get install ca-certificates

bin/root update-ca-certificates

Errors

OC SHIM error

Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init:

• Also if you run into an OC SHIM error when running bin/start try bin/remove and run bin/start again ;)

• This may be caused by not stopping containers before restartting

  noticed this happened to me right after install sourceguardian and running bin/restart without bin/stopall