Weave Code
Ca Bundle Laravel Package
composer/ca-bundle
A small PHP library that locates the system CA bundle and falls back to a bundled Mozilla CA file when none is found. Includes helpers for curl, PHP streams, and Guzzle, plus CA file validation and cache reset support.
Lets you find a path to the system CA bundle, and includes a fallback to the Mozilla CA bundle.
Frequently asked questions about Ca Bundle
- How do I install composer/ca-bundle in a Laravel application?
- Install it with composer require composer/ca-bundle. There is no Laravel service provider, facade, or config publishing step because the package exposes only static methods. In a Laravel app, wrap Composer\CaBundle\CaBundle behind a small resolver or config file so your application code depends on your abstraction rather than the vendor class.
- Does composer/ca-bundle support Laravel 9, 10, and 11?
- The package is framework-agnostic, so Laravel support is really a PHP version question. Version 1.5.x dropped PHP 7.1 and below, and any Laravel 9, 10, or 11 target on PHP 8.0 or newer can use it. Pin to ^1.5 for modern applications and keep 1.4.x only if you still have legacy services on PHP 7.x.
- How do I use composer/ca-bundle with Laravel's HTTP client or Guzzle?
- Laravel's HTTP client wraps Guzzle, so pass the CA path through the verify request option using withOptions. Guzzle's verify option expects a file path, not a directory, so you must branch on what getSystemCaRootBundlePath returns. If it returns a directory, use true to let cURL use its compiled default or use getBundledCaBundlePath for a concrete file path.
- Why does Guzzle fail when getSystemCaRootBundlePath returns a directory?
- On many Debian and Ubuntu systems the system CA bundle is a directory, not a single PEM file. Guzzle's verify option only handles a file path, so passing a directory is a silent misconfiguration rather than an obvious error. Branch in your adapter: use true or the bundled CA file when you get a directory, and pass the file path when you get a file.
- Do I need to call CaBundle::reset when using Laravel Octane?
- Yes, you should plan for it under long-lived workers such as Octane, RoadRunner, or Swoole. The resolver memoizes results statically, so a rotated bundle or changed environment will not be re-read unless reset is called. Add an explicit lifecycle hook or worker boot step, and call reset when configuration or the underlying CA store is expected to change.
- What is the difference between getSystemCaRootBundlePath and getBundledCaBundlePath?
- getSystemCaRootBundlePath tries to locate the system CA store and falls back to the bundled Mozilla CA file when none is found. getBundledCaBundlePath always returns the path to the cacert.pem shipped inside the vendor directory. The fallback triggers on not found, not on found but outdated, so a stale base image can still produce working-looking code with failing TLS. Treat the bundled file as a last resort and plan image rebuilds or composer update cycles to keep it fresh.
- Does validateCaFile check whether my CA bundle is up to date?
- No. validateCaFile is a file sanity check that uses openssl_x509_parse only when isOpensslParseSafe says it is safe to do so. It is not a freshness check and will not tell you whether the Mozilla bundle or system store is outdated. Use it to catch malformed or unreadable files, and manage CA freshness through your image rebuild and dependency update process.
- How do I fix cURL error 60 or SSL certificate problem in a Laravel Docker container?
- That error usually means the container cannot find or trust the expected CA store. Use composer/ca-bundle to locate the system bundle or fall back to the Mozilla file, then point cURL at it with CURLOPT_CAINFO for a file or CURLOPT_CAPATH for a directory. For Laravel's HTTP client or Guzzle, pass the same resolved value as the verify option. Alpine, distroless, and scratch-based images are the most common places to need this.
- Does composer/ca-bundle respect CURL_CA_BUNDLE or SSL_CERT_FILE environment variables?
- Do not assume the package gives those environment variables priority; its job is to find the system bundle and fall back to the bundled file. If your platform standardizes on CURL_CA_BUNDLE or SSL_CERT_FILE, build that precedence into your own adapter and use CaBundle as the fallback. Document the order clearly so operators know which value wins in containers and CI.
- Is composer/ca-bundle maintained and safe to use in production Laravel apps?
- It is a small, dependency-free utility from the Composer project, and its provenance is a strong assurance signal. Both 1.4.x and 1.5.x receive CA updates, so choosing a branch is an explicit governance decision rather than a bug fix. For production, pin ^1.5 on PHP 8+, test the directory-versus-file branch in your Guzzle configuration, and remember that the bundled cacert.pem ages with your deployed image.
Weaver
How can I help you explore Laravel packages today?