curl: Fallback to using Certificate Authority from Windows Certificate Store

Description

In PHP's current implementation, there is an inconsistency in how the language handles SSL/TLS certificate validation across different operating systems. This inconsistency primarily affects Windows users.

In this proof-of-concept, we can see the behavior clearly:

On Windows, the script does two requests:

1. The first request without a CA file that fails and prints Request correctly failed without CA certificate (expected on Windows)
2. A second request using the CA file from Mozilla that succeeds and prints Request succeeded with provided CA certificate

On Linux and Mac, it uses the O.S CA file, which prints Request succeeded without CA certificate (expected on Linux and macOS)

On Linux, it uses by default:

CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs

On Mac, it uses:

CAPath: /usr/local/etc/openssl@3/certs

On Windows, both are blank:

CAfile: (empty)
CApath: (empty)

Which means that PHP doesn't have a fallback Certificate Authority file to validate HTTPS requests, which leads to issues such as these. The common solution for this problem for Windows users is to download a trusted CA file (such as from Mozilla), and update php.ini to use it:

• Download http://curl.haxx.se/ca/cacert.pem
• Point php.ini openssl.cafile to the downloaded file

This is a sub-optimal solution as it increases complexity for the average John Doe that just wants to do a network request against a HTTPS URL.

I think PHP in Windows could fallback to accessing the Windows Certificate Store, or bundle a trusted CA file, although this might get outdated.

Không có tệp repository hoặc bài kiểm thử nào được nêu. Hãy bắt đầu bằng việc xem xét proof of concept Windows được liên kết và hành vi hiện tại của PHP khi xác thực chứng chỉ HTTPS, sau đó xác định phương án fallback nào được hỗ trợ; công việc được xem là hoàn tất khi các yêu cầu Windows xác thực được các chứng chỉ đáng tin cậy mà không cần một tệp CA được cấu hình riêng.