I want to validate my SSL certificate each time I run API calls. I've been following this guide:
http://artur.ejsmont.org/blog/content/how-to-properly-secure-remote-api-calls-from-php-application
This is my code:
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://api-3t.sandbox.paypal.com/nvp");
curl_setopt($ch, CURLOPT_POSTFIELDS, ($apiCredentials . $nvpStr));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); //Returnerar resultatet istället för att skriva ut det
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, curlopt_cainfo, (dirname(__FILE__) . '/cacert.pem'));
$response = curl_exec($ch);
The problem is that my SSL cert is not validated at all - it seems the file cacert.pem isn't even checked! I have changed name of the file, deleted it, and I've even tried editing it by removing all certificates in the cacert.pem file that are from my certificate issuer. The API call is still run no matter what!
What might the problem be?