Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

Pixelairport's avatar

API Gateway shows "cURL error 60: SSL certificate problem" in Postman

I have a API Gateway (Laravel) and a Microservice (also Laravel) running in homestead. Now i tried to use Postman to do a request to API Gateway, which use Guzzle to redirect the request to the right microservice. But Postman shows the error: "cURL error 60: SSL certificate problem: unable to get local issuer certificate (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://st-files.test/api/me".

I found a lot of blog posts and i think i tested everything. Also generated pem file and put it in php.ini or set the key and crt files in postman, ... I wasted the whole sunday and I'm still at the beginning with this problem. Maybe somebody has an idea what else can i do? What do I have to do to do this? I dont want to disable validation, because later when I go live I would have the same problem.

I found also a solution, which says to download a cacert.pem file from https://curl.haxx.se/ca/cacert.pem and put this in php. Is that making sense? I mean a certificate should be unique... and this would be a file which everytbody could download?!

0 likes
3 replies
fylzero's avatar

@pixelairport Try this.

There is a known issue on Mac that if you use Homebrew you may have to do a thing to get Laravel’s Http client to communicate locally to another domain.

brew uninstall curl-openssl --ignore-dependencies
brew services restart php
valet restart

No idea if this is the same with postman, but worth a try.

1 like
Pixelairport's avatar

Thx for your post, but i dont use valet. I also just tested it with normal get routes from my server. I have the same problems now. I think it is because i use https to connect from my gateway server to my microservice. When I call microservice direct it works. Also wenn i only want information from gateway server. Just when the gw connects to ms the problem is there.

Next I will try to copy the right certifacte on my server. Or is this the false way? Should I use http only? I think this would be take away security or not?

PS: Certificate is already setup on my os keychain. So the chrome browser says it is secure. It is only my gw server.

Please or to participate in this conversation.