How to Ignore SSL Certificate Errors with Guzzle?

You can ignore SSL certificate errors in Guzzle by setting the verify option to false. You can apply this setting to one request or when creating a Guzzle client.

Use it only for local testing or trusted self-signed certificates because disabling SSL verification removes an important security check. verify is true by default, and setting it to false switches off both the certificate check and the hostname check, so the connection is no longer protected against man-in-the-middle attacks.

Without it, a bad certificate makes Guzzle throw a GuzzleHttp\Exception\RequestException with a message that starts with cURL error 60: SSL certificate problem.

Disable SSL Verification for a Single Request

Use this method when only one Guzzle request needs to ignore SSL certificate errors.

The example below sets verify to false in the request options:

<?php
require 'vendor/autoload.php';

use GuzzleHttp\Client;

$client = new Client();

$response = $client->request(
    'GET',
    'https://self-signed.badssl.com/',
    [
        'verify' => false,
    ]
);

echo $response->getStatusCode();

If we run the script after disabling verification, we still get a 200 status code, which confirms that Guzzle completed the request after certificate verification was disabled for that request:

The verify option only applies to this one call, so any other request made through $client still validates certificates normally.

Disable SSL Verification for All Client Requests

Set verify while creating the client. This ensures every request sent through that client uses the same setting:

<?php
require 'vendor/autoload.php';

use GuzzleHttp\Client;

$client = new Client([
    'verify' => false,
]);

$response = $client->request(
    'GET',
    'https://self-signed.badssl.com/'
);

echo $response->getStatusCode() . "\n";

The output is also a 200, which is a success. This time, verify => false applies to every request sent through $client:

Constructor options act as defaults, so you can still pass 'verify' => true in the options of an individual request to re-enable verification for that call.

Use a Custom CA Certificate Instead

A safer solution is to provide Guzzle with a trusted CA certificate bundle instead of setting verify to false.

The following example sets verify to the path of a CA bundle:

<?php
require 'vendor/autoload.php';

use GuzzleHttp\Client;

$client = new Client([
    'verify' => '/actual/path/to/cacert.pem',
]);

$response = $client->request(
    'GET',
    'https://your-server.example'
);

echo $response->getStatusCode();

Replace /actual/path/to/cacert.pem with the real path to your trusted CA bundle and replace the URL with your server.

When verify contains a file path, Guzzle uses that CA bundle to validate the server certificate. The output depends on the server, but a successful request prints its HTTP status code. A directory of certificates works too, and Guzzle throws an InvalidArgumentException reading SSL CA bundle not found if the path does not exist.

If you need a general-purpose bundle rather than your own certificate, the maintainer of cURL publishes the Mozilla CA bundle. You can also point the openssl.cafile setting in your php.ini at a bundle on disk, which lets you leave the verify option out entirely.

Related Guzzle web scraping questions: