Fix for WSL Ubuntu: Error 60 with cURL and Composer

[its-leofisher]

I wanted to share this for those of you behind a firewall/vpn, that you can't easily disable and in my case Zscaler on Windows using WSL Ubuntu. I was receiving "curl error 60" when running bin/start and bin/composer update. I had help from issue #930 but wasn't able to get it to work for me due to a few minor steps.

If you are using WSL for the first time you may also need to perform similar steps for your Ubuntu host so its about 3 levels of configuration. Key point is that I believe bin/start error is running as a OS level cURL command and bin/composer update is running the curl extension through PHP.

No other steps of downloading a pem from https://curl.se/docs/caextract.html works. It has to be the certificate generated from Zscaler, one other reminder is that the .cer file generated in the following steps is under the hood a .pem file. So it should be named cacert.pem to match default configurations of the OS level cURL. For PHP cURL at a later step it should be named cert.pem.

The Levels:

1. WSL: Ubuntu OS cURL
2. Container: OS level cURL
3. Container: PHP cURL extension

The Errors:

Errors returned when running bin/start or to test bin/root curl -v https://www.google.com

In CurlDownloader.php line 372:
  curl error 60 while downloading https://repo.packagist.org/packages.json: SSL
  certificate problem: unable to get local issuer certificate

curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

Error returned when running bin/composer update

Loading composer repositories with package information

In CurlDownloader.php line 372:

  curl error 60 while downloading https://repo.magento.com/packages.json: SSL certificate problem: unable to get local issuer certificate

The Steps

Step 0: Generating .cer from Zscaler

These are the steps for Windows users to generate the .cer from Zscaler, slightly modified from this Stack Overflow

1. Open the certificate manager (Start > Run > certlm.msc)
2. Find the certificate in the Trusted Root Certification Authorities\Certificates folder. Should be named Zscalar Root CA.
3. Right click it, then choose All Tasks > Export...
4. Click Next
5. Select the Base-64 encoded X.509 (.CER) option
6. Save the file to your Ubuntu location like `\\wsl.localhost\Ubuntu` in my case i put it in `\\wsl.localhost\Ubuntu\home\<username>\<yourMarkShustDockerLocation>\src`

Make sure the file name is cacert.pem

Step 1: Copy cacert.pem from \src to container

Below command places it in the containers /var/www/html location, it also sets ownership and permissions for you... 🙌 @markshust.

• bin/copytocontainer cacert.pem

Step 2: For Container OS Level cURL:

• Copy it from /var/www/html to /etc/ssl/certs/ with bin/root cp /var/www/html/cacert.pem /etc/ssl/certs/

• For sanity check: bin/root ls /etc/ssl/certs

Step 3: For Container PHP cURL:

• Copy it with: bin/root cp /etc/ssl/certs/cacert.pem /usr/lib/ssl/cert.pem

  • Note that the last command renamed the cert, since by default php.ini is configured to look for cert.pem inside of /usr/lib/ssl

Step 4: Now test

• Curl command bin/root curl -v https://www.google.com. Error is gone, just a bunch of source code!

• composer with bin/composer update. Error no longer exists!

Step 5: Automate

After all the above steps, and with some understanding on whats going on, this can be automated which is WIP

That's it now go develop stuff.

Reference:

Os Level cURL cert location: /etc/ssl/certs/cacert.pem

PHP level cert location: /usr/lib/ssl/cert.pem

Windows zscaler certificate steps: https://serverfault.com/a/1157586/239509

Issue that helped with this write up: #930

Additional Notes:

You may need to run these commands in your WSL:

sudo apt-get install ca-certificates

bin/root update-ca-certificates

Errors

OC SHIM error

Thrown when running bin/start:

Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init

• First read the error thoroughly, make sure the file its referencing actually exists in the directory its looking under.

• As a complete refresh run bin/remove and run bin/start again

  • If you haven't automated adding certs to the container, you would have to perform steps again.

• This may be caused by not stopping containers before re-starting

  noticed this happened after install sourceguardian and running bin/restart without bin/stopall

[its-leofisher]

Another similar issue appeared when running npm install so needed to add the cert file to npm. npm config set cafile usr/lib/ssl/cert.pem if that doesn't work then add an environment variable to compose.yaml under the PHP entry:

  phpfpm:
    image: markoshust/magento-php:8.3-fpm-2
    volumes: *appvolumes
    env_file: env/phpfpm.env
    environment:
        NODE_EXTRA_CA_CERTS=usr/lib/ssl/cert.pem
    #extra_hosts: *appextrahosts