3

Anyone seen this particular error before when trying to sync Civi contacts to Mailchimp?

API call to lists/batch-unsubscribe failed: SSL certificate problem: unable to get local issuer certificate

Googling this didn't turn up much that was helpful; I've inquired of Mailchimp but have yet to hear back.

CiviCRM 4.4.14/Mailchimp extension v 1.7

Thanks in advance, Lesley

  • I have seen exactly the same error. But have not yet found time to track down the reason. What I have noticed is there was an updates on the certificate package it could be that mailchimp uses a certifica from an authority which is not in it anymore. What OS incl. Version, and what CMS are you using? – Alain Schaefer Feb 3 '16 at 9:45
  • This is a WordPress site. Both the client (on a Mac, I believe) and I (on Windows 7) have replicated this - it doesn't seem to me to be a client-side issue although I could well be mistaken. – Lesley Carter - BackOffice Feb 3 '16 at 14:55
  • 1
    For folks' edification, this is the response I received from Mailchimp: MailChimp is hosted on the Akamai network and this error can occur when the client's curl library does not include all of the certificates in our certificate chain. To resolve the issue, it's possible to download and include missing certificates manually into curl's bundle. Here's is a link to the certificates you'd need: certificate.fyicenter.com/… – Lesley Carter - BackOffice Feb 4 '16 at 20:59
2

If you are on Linux, I found this explanation (https://www.drupal.org/node/2477693) :

The Root CA used to sign *.api.mailchimp.com was removed from Mozilla NSS CA > Certificates bundle in February 2015, and was removed from Debian 8's ca-certificates package in January 2016.

I used this method to solve the problem :

  1. Download cacert.pem file from here: https://curl.haxx.se/ca/cacert.pem
  2. Add this Mailchimp CA cert at the end of cacert.pem :

    GTE_CyberTrust_Global_Root
    ==========================
    -----BEGIN CERTIFICATE-----
    MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD
    VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv
    bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv
    b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV
    UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU
    cnVzdCBTb2x1dGlvbnMsIEluYy4xIzAhBgNVBAMTGkdURSBDeWJlclRydXN0IEds
    b2JhbCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrH
    iM3dFw4usJTQGz0O9pTAipTHBsiQl8i4ZBp6fmw8U+E3KHNgf7KXUwefU/ltWJTS
    r41tiGeA5u2ylc9yMcqlHHK6XALnZELn+aks1joNrI1CqiQBOeacPwGFVw1Yh0X4
    04Wqk2kmhXBIgD8SFcd5tB8FLztimQIDAQABMA0GCSqGSIb3DQEBBAUAA4GBAG3r
    GwnpXtlR22ciYaQqPEh346B8pt5zohQDhT37qw4wxYMWM4ETCJ57NE7fQMh017l9
    3PR2VX2bY1QY6fDq81yx2YtCHrnAlU66+tXifPVoYb+O7AWXX1uw16OFNMQkpw0P
    lZPvy5TYnh+dXIVtx6quTx8itc2VrbqnzPmrC3p/
    -----END CERTIFICATE-----
    
  3. Save the file in your PHP configuration folder.

  4. Open your /etc/php5/apache2/php.ini file and add this line:

    curl.cainfo="/etc/php5/apache2/cacert.pem"

  5. Restart your Apache server and that should fix it.

1

I am not sure if the poster is on Debian Jessie. But if yes, then the correct solution is to reinstall the ca-certificates package. It seems this is a bug with a recent package update of ca-certificates.

apt-get --reinstall install ca-certificates
0

The other answers are definitely more "correct" than this one - but I had this problem for a while when my client's host ran a very old version of FreeBSD with a different set of root certificates. Until I was able to fix the problem properly, I did this. Note that "line 108" is probably no longer correct - these notes are a year old.

In the Mailchimp extension, in vendor/mailchimp/Mailchimp.php, line 108, I changed it from:

public $ssl_verifypeer = true;

to:

public $ssl_verifypeer = false;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.