Answers.Body: <p>The issue is that the SSL certificate provided by your transaction processor is untrusted by your OS (or by the certs available to cURL).</p>
  
  <p>The solution for a missing CA is -</p>
  
  <ul>
  <li>to ensure the presence of correct CA certificates to cURL by installing system CA updates, or </li>
  <li>to retrieve an old copy of the correct CA and make it available to cURL if the one used by your payment processor is invalid (see AGH link below).</li>
  </ul>
  
  <p>Since the error message contains <code>SSL3_GET_SERVER_CERTIFICATE</code>, I wonder if this is happening because your payment processor extension is attempting to use SSLv3 (recently deprecated). You might want to check that if there are any references to <code>CURLOPT_SSLVERSION</code> in your payment processor, they are not set to <code>3</code>. (You can set them to <code>0</code> as in <a href="https://github.com/mattrenner/civicrm-core/commit/9120cfd9fcc971d1628b14dc3e0f1f17c11cc6ac" rel="nofollow">this fix</a> or simply remove the line.)</p>
  
  <p>This issue was documented by AGH Strategies recently:</p>
  
  <ul>
  <li><a href="https://aghstrategies.com/content/SSL3_GET_SERVER_CERTIFICATE" rel="nofollow">https://aghstrategies.com/content/SSL3_GET_SERVER_CERTIFICATE</a></li>
  </ul>
  
  <p>Authorize.NET say that you should make available three root CAs ("production certificate upgrades") link below. </p>
  
  <blockquote>
    <p><em>"Please contact your solution provider and web hosting company to ensure your solution has these certificates installed and is capable of using them to secure your connection to Authorize.Net. In many cases the certificates may already be installed."</em></p>
  </blockquote>
  
  <ul>
  <li><a href="http://www.authorize.net/support/poodlefaqs/" rel="nofollow">POODLE FAQs</a></li>
  <li><a href="http://community.developer.authorize.net/t5/The-Authorize-Net-Developer-Blog/Authorize-Net-Begins-Infrastructure-and-SHA-2-Certificate/ba-p/49615" rel="nofollow">Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades</a></li>
  <li><a href="http://community.developer.authorize.net/t5/The-Authorize-Net-Developer-Blog/Production-Certificate-Upgrades-begin-May-27-2015/ba-p/50430" rel="nofollow">Production Certificate Upgrades begin May 27 2015</a></li>
  </ul>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-06-11T03:09:01.083Z
Answers.Text: Yeah, I'm super-unhappy about the "solution" we posted, but that's the fundamental problem: Authorize.net is using an old certificate and hasn't updated it for months now even though it's a problem on nearly any Ubuntu box.  Trusting it--so you can post contributions--requires reviving an old, insecure CA certificate.
Answers.UserDisplayName: Andie Hunt
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-06-10T02:24:17.897Z
Answers.LastActivityDate: 2015-06-11T19:49:26.013Z
Answers.LastEditDate: 2015-06-11T19:49:26.013Z
Answers.UserDisplayName: Chris Burgess
Body: <p>I'm having issues with this order form (<a href="https://www.aishla.com/myaish/israel-trip-payment-form/#.VXc3Gud4zmE" rel="nofollow">https://www.aishla.com/myaish/israel-trip-payment-form/#.VXc3Gud4zmE</a>) where people are trying to purchase a trip but when they try to process a card they get the following error:</p>
  
  <blockquote>
    <p>Payment Processor Error message
    60: SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed</p>
  </blockquote>
  
  <p>This is on a WPMU site using 4.5 of CiviCRM hosted on Lunarpages with Authorize.net as the payment processor.</p>
  
  <p>Anuone know what steps I can take to correct this?</p>
  
Tags: <payment-processor>
Title: SSL/ Payment Processor Errors on payment form
ThreadText: # SSL/ Payment Processor Errors on payment form
  
  (Asked by: username_0 on 2015-06-09)
  
  I'm having issues with this order form (<https://www.aishla.com/myaish/israel-trip-payment-form/#.VXc3Gud4zmE>) where people are trying to purchase a trip but when they try to process a card they get the following error:
  
  > Payment Processor Error message
  > 60: SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3\_GET\_SERVER\_CERTIFICATE:certificate verify failed
  
  This is on a WPMU site using 4.5 of CiviCRM hosted on Lunarpages with Authorize.net as the payment processor.
  
  Anuone know what steps I can take to correct this?
  
  **Tags:** payment-processor
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2015-06-10. Score: 4
  
  The issue is that the SSL certificate provided by your transaction processor is untrusted by your OS (or by the certs available to cURL).
  
  The solution for a missing CA is -
  
  * to ensure the presence of correct CA certificates to cURL by installing system CA updates, or
  * to retrieve an old copy of the correct CA and make it available to cURL if the one used by your payment processor is invalid (see AGH link below).
  
  Since the error message contains `SSL3_GET_SERVER_CERTIFICATE`, I wonder if this is happening because your payment processor extension is attempting to use SSLv3 (recently deprecated). You might want to check that if there are any references to `CURLOPT_SSLVERSION` in your payment processor, they are not set to `3`. (You can set them to `0` as in [this fix](https://github.com/mattrenner/civicrm-core/commit/9120cfd9fcc971d1628b14dc3e0f1f17c11cc6ac) or simply remove the line.)
  
  This issue was documented by AGH Strategies recently:
  
  * <https://aghstrategies.com/content/SSL3_GET_SERVER_CERTIFICATE>
  
  Authorize.NET say that you should make available three root CAs ("production certificate upgrades") link below.
  
  > *"Please contact your solution provider and web hosting company to ensure your solution has these certificates installed and is capable of using them to secure your connection to Authorize.Net. In many cases the certificates may already be installed."*
  
  * [POODLE FAQs](http://www.authorize.net/support/poodlefaqs/)
  * [Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades](http://community.developer.authorize.net/t5/The-Authorize-Net-Developer-Blog/Authorize-Net-Begins-Infrastructure-and-SHA-2-Certificate/ba-p/49615)
  * [Production Certificate Upgrades begin May 27 2015](http://community.developer.authorize.net/t5/The-Authorize-Net-Developer-Blog/Production-Certificate-Upgrades-begin-May-27-2015/ba-p/50430)
  
  > **Comments:**
  > **username_2**: Yeah, I'm super-unhappy about the "solution" we posted, but that's the fundamental problem: Authorize.net is using an old certificate and hasn't updated it for months now even though it's a problem on nearly any Ubuntu box.  Trusting it--so you can post contributions--requires reviving an old, insecure CA certificate.  
  
  ---
  
  