500 Error: Curl certificate issues when making project-to-project calls

[fullstackfool]

I'm hitting an immovable wall of (what seem to be) curl certificate errors. The latest exception is:

cURL error 60: SSL certificate problem: unable to get local issuer certificate (see http://curl.haxx.se/libcurl/c/libcurl-errors.html)

Previous exceptions have been invalid RSA padding and data too large for modulus.

All projects are https.

What I've established:

• Occurs when using the Http facade to communicate between 2 local APIs.
• Browser to API is fine.
• API to external URL, like google.com, is fine.
• The project choices don't matter. Happens between any 2 local APIs.

What I've tried:

• [email protected]
• [email protected]
• valet@latest
• [email protected]
• [email protected]
• Copied the valet certs to /usr/local/etc/[email protected]/certs
• Copied the valet certs to /etc/ssl/certs
• Completely wiped the system, erased the drive, reinstalled [email protected]
• Rebuilt development environments from scratch
• configuring php ini curl.cainfo with cert path
• configuring php ini openssl.cafile with cert path
• configuring php ini openssl.capath with cert path

sw_vers

ProductName:	macOS
ProductVersion:	12.2.1
BuildVersion:	21D62

valet --version

Laravel Valet 2.17.1

cat ~/.config/valet/config.json

{
    "tld": "test",
    "loopback": "127.0.0.1",
    "paths": [
        "/Users/karldavies/.config/valet/Sites"
    ]
}

cat ~/.composer/composer.json

{
    "require": {
        "laravel/valet": "2.17.1"
    }
}

composer global diagnose

Changed current directory to /Users/karldavies/.composer
Checking composer.json: WARNING
No license specified, it is recommended to do so. For closed-source software you may use "proprietary" as license.
require.laravel/valet : exact version constraints (2.17.1) should be avoided if the package follows semantic versioning
Checking platform settings: OK
Checking git settings: OK
Checking http connectivity to packagist: OK
Checking https connectivity to packagist: OK
Checking github.com rate limit: OK
Checking disk free space: OK
Checking pubkeys: FAIL
Missing pubkey for tags verification
Missing pubkey for dev verification
Run composer self-update --update-keys to set them up
Checking composer version: OK
Composer version: 2.2.6
PHP version: 8.0.16
PHP binary path: /usr/local/Cellar/[email protected]/8.0.16/bin/php
OpenSSL version: OpenSSL 1.1.1m  14 Dec 2021
cURL version: 7.81.0 libz 1.2.11 ssl (SecureTransport) OpenSSL/1.1.1m
zip: extension present, unzip present, 7-Zip not available

composer global outdated

Changed current directory to /Users/karldavies/.composer
Legend:
! patch or minor release available - update recommended
~ major release available - update possible
illuminate/container          v8.83.2 ~ v9.2.0  The Illuminate Container package.
illuminate/contracts          v8.83.2 ~ v9.2.0  The Illuminate Contracts package.
laravel/valet                 v2.17.1 ! v2.18.9 A more enjoyable local development experience for Mac.
nategood/httpful              0.2.20  ~ 0.3.2   A Readable, Chainable, REST friendly, PHP HTTP Client
psr/container                 1.1.2   ~ 2.0.2   Common Container Interface (PHP FIG PSR-11)
psr/simple-cache              1.0.1   ~ 3.0.0   Common interfaces for simple caching
symfony/deprecation-contracts v2.5.0  ~ v3.0.0  A generic function and convention to trigger deprecation notices
symfony/process               v5.4.3  ~ v6.0.3  Executes commands in sub-processes
symfony/service-contracts     v2.5.0  ~ v3.0.0  Generic abstractions related to writing services
tightenco/collect             v8.83.1 ~ v9.0.2  Collect - Illuminate Collections as a separate package.

ls -al /etc/sudoers.d/

total 0
drwxr-xr-x   2 root  wheel    64 Feb  6 21:22 .
drwxr-xr-x  82 root  wheel  2624 Feb 22 19:32 ..

brew config

HOMEBREW_VERSION: 3.3.16
ORIGIN: https://github.com/Homebrew/brew
HEAD: 2dc375acc2fe4e089d103171ec8fb06a87d83bb6
Last commit: 2 days ago
Core tap ORIGIN: https://github.com/Homebrew/homebrew-core
Core tap HEAD: 0aac4f7a1500353f3726dffaaf07e92794054029
Core tap last commit: 37 minutes ago
Core tap branch: master
HOMEBREW_PREFIX: /usr/local
HOMEBREW_CASK_OPTS: []
HOMEBREW_CORE_GIT_REMOTE: https://github.com/Homebrew/homebrew-core
HOMEBREW_MAKE_JOBS: 12
Homebrew Ruby: 2.6.8 => /System/Library/Frameworks/Ruby.framework/Versions/2.6/usr/bin/ruby
CPU: dodeca-core 64-bit kabylake
Clang: 13.0.0 build 1300
Git: 2.30.1 => /Library/Developer/CommandLineTools/usr/bin/git
Curl: 7.77.0 => /usr/bin/curl
macOS: 12.2.1-x86_64
CLT: 13.0.0.0.1.1627064638
Xcode: N/A

brew services list

Name    Status User       File
dnsmasq none            root       
mysql   started         karldavies ~/Library/LaunchAgents/homebrew.mxcl.mysql.plist
nginx   none            root       
php     none                       
[email protected] none            root

brew list --formula --versions | grep -E "(php|nginx|dnsmasq|mariadb|mysql|mailhog|openssl)(@\d\..*)?\s"

dnsmasq 2.86
mysql 8.0.28
nginx 1.21.6
[email protected] 1.1.1m
php 8.1.3
[email protected] 8.0.16

brew outdated

brew tap

homebrew/cask
homebrew/core
homebrew/services

php -v

PHP 8.0.16 (cli) (built: Feb 18 2022 09:31:10) ( NTS )
Copyright (c) The PHP Group
Zend Engine v4.0.16, Copyright (c) Zend Technologies
    with Zend OPcache v8.0.16, Copyright (c), by Zend Technologies

which -a php

/usr/local/bin/php

php --ini

Configuration File (php.ini) Path: /usr/local/etc/php/8.0
Loaded Configuration File:         /usr/local/etc/php/8.0/php.ini
Scan for additional .ini files in: /usr/local/etc/php/8.0/conf.d
Additional .ini files parsed:      /usr/local/etc/php/8.0/conf.d/error_log.ini,
/usr/local/etc/php/8.0/conf.d/ext-opcache.ini,
/usr/local/etc/php/8.0/conf.d/php-memory-limits.ini

nginx -v

nginx version: nginx/1.21.6

curl --version

curl 7.77.0 (x86_64-apple-darwin21.0) libcurl/7.77.0 (SecureTransport) LibreSSL/2.8.3 zlib/1.2.11 nghttp2/1.42.0
Release-Date: 2021-05-26
Protocols: dict file ftp ftps gopher gophers http https imap imaps ldap ldaps mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp 
Features: alt-svc AsynchDNS GSS-API HSTS HTTP2 HTTPS-proxy IPv6 Kerberos Largefile libz MultiSSL NTLM NTLM_WB SPNEGO SSL UnixSockets

php --ri curl

curl
cURL support => enabled

cURL Information => 7.81.0

Age => 9

Features

AsynchDNS => Yes

CharConv => No

Debug => No

GSS-Negotiate => No

IDN => Yes

IPv6 => Yes

krb4 => No

Largefile => Yes

libz => Yes

NTLM => Yes

NTLMWB => Yes

SPNEGO => Yes

SSL => Yes

SSPI => No

TLS-SRP => Yes

HTTP2 => Yes

GSSAPI => Yes

KERBEROS5 => Yes

UNIX_SOCKETS => Yes

PSL => No

HTTPS_PROXY => Yes

MULTI_SSL => Yes

BROTLI => Yes

Protocols => dict, file, ftp, ftps, gopher, gophers, http, https, imap, imaps, ldap, ldaps, mqtt, pop3, pop3s, rtmp, rtsp, scp, sftp, smb, smbs, smtp, smtps, telnet, tftp

Host => x86_64-apple-darwin21.1.0

SSL Version => (SecureTransport) OpenSSL/1.1.1m

ZLib Version => 1.2.11

libSSH Version => libssh2/1.10.0
Directive => Local Value => Master Value

curl.cainfo => no value => no value

~/.composer/vendor/laravel/valet/bin/ngrok version

ngrok version 2.3.40

ls -al ~/.ngrok2

ls: /Users/karldavies/.ngrok2: No such file or directory

brew info nginx

nginx: stable 1.21.6 (bottled), HEAD
HTTP(S) server and reverse proxy, and IMAP/POP3 proxy server
https://nginx.org/
/usr/local/Cellar/nginx/1.21.6 (26 files, 2.2MB) *
  Poured from bottle on 2022-02-22 at 17:24:58
From: https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/nginx.rb
License: BSD-2-Clause
==> Dependencies
Required: [email protected], pcre
==> Options
--HEAD
	Install HEAD version
==> Caveats
Docroot is: /usr/local/var/www
The default port has been set in /usr/local/etc/nginx/nginx.conf to 8080 so that

nginx can run without sudo.
nginx will load all files in /usr/local/etc/nginx/servers/.
To restart nginx after an upgrade:

brew services restart nginx

Or, if you don't want/need a background service you can just run:

/usr/local/opt/nginx/bin/nginx -g daemon off;

==> Analytics

install: 44,616 (30 days), 109,125 (90 days), 499,155 (365 days)

install-on-request: 44,556 (30 days), 108,957 (90 days), 498,082 (365 days)

build-error: 103 (30 days)

brew info php

php: stable 8.1.3 (bottled), HEAD
General-purpose scripting language
https://www.php.net/
/usr/local/Cellar/php/8.1.3 (513 files, 80MB)
  Poured from bottle on 2022-02-22 at 16:41:43
From: https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/php.rb
License: PHP-3.01
==> Dependencies
Build: httpd, pkg-config
Required: apr, apr-util, argon2, aspell, autoconf, curl, freetds, gd, gettext, gmp, icu4c, krb5, libpq, libsodium, libzip, oniguruma, openldap, [email protected], pcre2, sqlite, tidy-html5, unixodbc
==> Options
--HEAD
	Install HEAD version
==> Caveats
To enable PHP in Apache add the following to httpd.conf and restart Apache:
    LoadModule php_module /usr/local/opt/php/lib/httpd/modules/libphp.so
<FilesMatch \.php$>
    SetHandler application/x-httpd-php
</FilesMatch>

Finally, check DirectoryIndex includes index.php

DirectoryIndex index.php index.html
The php.ini and php-fpm.ini file can be found in:

/usr/local/etc/php/8.1/
To restart php after an upgrade:

brew services restart php

Or, if you don't want/need a background service you can just run:

/usr/local/opt/php/sbin/php-fpm --nodaemonize

==> Analytics

install: 122,551 (30 days), 336,203 (90 days), 849,872 (365 days)

install-on-request: 100,811 (30 days), 271,621 (90 days), 757,999 (365 days)

build-error: 84 (30 days)

brew info openssl

openssl@3: stable 3.0.1 (bottled) [keg-only]
Cryptography and SSL/TLS Toolkit
https://openssl.org/
Not installed
From: https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/[email protected]
License: Apache-2.0
==> Dependencies
Required: ca-certificates
==> Caveats
A CA file has been bootstrapped using certificates from the system
keychain. To add additional certificates, place .pem files in
  /usr/local/etc/openssl@3/certs
and run

/usr/local/opt/openssl@3/bin/c_rehash
openssl@3 is keg-only, which means it was not symlinked into /usr/local,

because macOS provides LibreSSL.
==> Analytics

install: 107,184 (30 days), 300,953 (90 days), 485,623 (365 days)

install-on-request: 82,736 (30 days), 228,310 (90 days), 379,785 (365 days)

build-error: 5,552 (30 days)

openssl version -a

LibreSSL 2.8.3
built on: date not available
platform: information not available
options:  bn(64,64) rc4(16x,int) des(idx,cisc,16,int) blowfish(idx) 
compiler: information not available
OPENSSLDIR: "/private/etc/ssl"

openssl ciphers

ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:GOST2012256-GOST89-GOST89:DHE-RSA-CAMELLIA256-SHA256:DHE-RSA-CAMELLIA256-SHA:GOST2001-GOST89-GOST89:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:CAMELLIA256-SHA256:CAMELLIA256-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-CAMELLIA128-SHA256:DHE-RSA-CAMELLIA128-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:CAMELLIA128-SHA256:CAMELLIA128-SHA:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:RC4-SHA:RC4-MD5:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:DES-CBC3-SHA

sudo nginx -t

nginx: the configuration file /usr/local/etc/nginx/nginx.conf syntax is ok
nginx: configuration file /usr/local/etc/nginx/nginx.conf test is successful

which -a php-fpm

/usr/local/opt/php/sbin/php-fpm -v

PHP 8.1.3 (fpm-fcgi) (built: Feb 18 2022 09:32:59)
Copyright (c) The PHP Group
Zend Engine v4.1.3, Copyright (c) Zend Technologies
    with Zend OPcache v8.1.3, Copyright (c), by Zend Technologies

sudo /usr/local/opt/php/sbin/php-fpm -y /usr/local/etc/php/8.0/php-fpm.conf --test

[22-Feb-2022 22:43:17] NOTICE: configuration file /usr/local/etc/php/8.0/php-fpm.conf test is successful

ls -al ~/Library/LaunchAgents | grep homebrew

-rw-r--r--   1 karldavies  staff   528 Feb 22 17:39 homebrew.mxcl.mysql.plist

ls -al /Library/LaunchAgents | grep homebrew

ls -al /Library/LaunchDaemons | grep homebrew

-rw-r--r--   1 root  admin   593 Feb 22 21:33 homebrew.mxcl.dnsmasq.plist
-rw-r--r--   1 root  admin   484 Feb 22 21:34 homebrew.mxcl.nginx.plist
-rw-r--r--   1 root  admin   585 Feb 22 21:32 [email protected]

ls -al /Library/LaunchDaemons | grep "com.laravel.valet."

ls -aln /etc/resolv.conf

lrwxr-xr-x  1 0  0  22 Feb  6 21:22 /etc/resolv.conf -> ../var/run/resolv.conf

cat /etc/resolv.conf

#
# macOS Notice
#
# This file is not consulted for DNS hostname resolution, address
# resolution, or the DNS query routing mechanism used by most
# processes on this system.
#
# To view the DNS configuration used by this system, use:
#   scutil --dns
#
# SEE ALSO
#   dns-sd(1), scutil(8)
#
# This file is automatically generated.
#
nameserver 8.8.8.8

ifconfig lo0

lo0: flags=8049 mtu 16384
	options=1203
	inet 127.0.0.1 netmask 0xff000000 
	inet6 ::1 prefixlen 128 
	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
	nd6 options=201

sh -c 'echo "------\n/usr/local/etc/nginx/valet/valet.conf\n---\n"; cat /usr/local/etc/nginx/valet/valet.conf | grep -n "# valet loopback"; echo "\n------\n"'

------
/usr/local/etc/nginx/valet/valet.conf
---
3:    #listen VALET_LOOPBACK:80; # valet loopback
------

sh -c 'for file in ~/.config/valet/dnsmasq.d/*; do echo "------\n~/.config/valet/dnsmasq.d/$(basename $file)\n---\n"; cat $file; echo "\n------\n"; done'

------
~/.config/valet/dnsmasq.d/tld-test.conf
---
address=/.test/127.0.0.1

listen-address=127.0.0.1
------

sh -c 'for file in ~/.config/valet/nginx/*; do echo "------\n~/.config/valet/nginx/$(basename $file)\n---\n"; cat $file | grep -n "# valet loopback"; echo "\n------\n"; done'

------
~/.config/valet/nginx/api1.test
---
3:    #listen 127.0.0.1:80; # valet loopback

10:    #listen 127.0.0.1:443 ssl http2; # valet loopback

54:    #listen 127.0.0.1:60; # valet loopback


~/.config/valet/nginx/api2.test
3:    #listen 127.0.0.1:80; # valet loopback

10:    #listen 127.0.0.1:443 ssl http2; # valet loopback

54:    #listen 127.0.0.1:60; # valet loopback


~/.config/valet/nginx/api3.test
3:    #listen 127.0.0.1:80; # valet loopback

10:    #listen 127.0.0.1:443 ssl http2; # valet loopback

54:    #listen 127.0.0.1:60; # valet loopback
------