3

Anyone seen this particular error before when trying to sync Civi contacts to Mailchimp?

API call to lists/batch-unsubscribe failed: SSL certificate problem: unable to get local issuer certificate

Googling this didn't turn up much that was helpful; I've inquired of Mailchimp but have yet to hear back.

CiviCRM 4.4.14/Mailchimp extension v 1.7

Thanks in advance, Lesley

Improve this question
3
  • I have seen exactly the same error. But have not yet found time to track down the reason. What I have noticed is there was an updates on the certificate package it could be that mailchimp uses a certifica from an authority which is not in it anymore. What OS incl. Version, and what CMS are you using?
    – Alain Schaefer
    Feb 3, 2016 at 9:45
  • This is a WordPress site. Both the client (on a Mac, I believe) and I (on Windows 7) have replicated this - it doesn't seem to me to be a client-side issue although I could well be mistaken.
    – Lesley Carter - BackOffice
    Feb 3, 2016 at 14:55
  • 1
    For folks' edification, this is the response I received from Mailchimp: MailChimp is hosted on the Akamai network and this error can occur when the client's curl library does not include all of the certificates in our certificate chain. To resolve the issue, it's possible to download and include missing certificates manually into curl's bundle. Here's is a link to the certificates you'd need: certificate.fyicenter.com/…
    – Lesley Carter - BackOffice
    Feb 4, 2016 at 20:59

3 Answers 3

Reset to default
2

If you are on Linux, I found this explanation (https://www.drupal.org/node/2477693) :

The Root CA used to sign *.api.mailchimp.com was removed from Mozilla NSS CA > Certificates bundle in February 2015, and was removed from Debian 8's ca-certificates package in January 2016.

I used this method to solve the problem :

  1. Download cacert.pem file from here: https://curl.haxx.se/ca/cacert.pem

  2. Add this Mailchimp CA cert at the end of cacert.pem :

    GTE_CyberTrust_Global_Root
==========================
-----BEGIN CERTIFICATE-----
MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD
VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv
bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv
b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV
UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU
cnVzdCBTb2x1dGlvbnMsIEluYy4xIzAhBgNVBAMTGkdURSBDeWJlclRydXN0IEds
b2JhbCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrH
iM3dFw4usJTQGz0O9pTAipTHBsiQl8i4ZBp6fmw8U+E3KHNgf7KXUwefU/ltWJTS
r41tiGeA5u2ylc9yMcqlHHK6XALnZELn+aks1joNrI1CqiQBOeacPwGFVw1Yh0X4
04Wqk2kmhXBIgD8SFcd5tB8FLztimQIDAQABMA0GCSqGSIb3DQEBBAUAA4GBAG3r
GwnpXtlR22ciYaQqPEh346B8pt5zohQDhT37qw4wxYMWM4ETCJ57NE7fQMh017l9
3PR2VX2bY1QY6fDq81yx2YtCHrnAlU66+tXifPVoYb+O7AWXX1uw16OFNMQkpw0P
lZPvy5TYnh+dXIVtx6quTx8itc2VrbqnzPmrC3p/
-----END CERTIFICATE-----

  3. Save the file in your PHP configuration folder.

  4. Open your /etc/php5/apache2/php.ini file and add this line:

    curl.cainfo="/etc/php5/apache2/cacert.pem"

  5. Restart your Apache server and that should fix it.

Improve this answer
1

I am not sure if the poster is on Debian Jessie. But if yes, then the correct solution is to reinstall the ca-certificates package. It seems this is a bug with a recent package update of ca-certificates.

apt-get --reinstall install ca-certificates
Improve this answer
0

The other answers are definitely more "correct" than this one - but I had this problem for a while when my client's host ran a very old version of FreeBSD with a different set of root certificates. Until I was able to fix the problem properly, I did this. Note that "line 108" is probably no longer correct - these notes are a year old.

In the Mailchimp extension, in vendor/mailchimp/Mailchimp.php, line 108, I changed it from:

public $ssl_verifypeer = true;

to:

public $ssl_verifypeer = false;
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.