Certificate validation issues in Matomo
When using a certificate for your Matomo host that is not signed by a public CA, you might get a warning message like this on Matomo’s system check page:
Unable to execute check for …: curl_exec: SSL certificate problem: unable to get local issuer certificate. Hostname requested was: …
This happens, even if the CA that signed the server certificate is actually registered as a root CA on the system where Matomo is running.
There is a (at the time of writing) misleading article in the Matomo documentation that suggests setting the curl.cainfo option in php.ini. However, this does not help because Matomo actually overrides this setting with its own bundled list of root CAs (in vendor/composer/ca-bundle/res/cacert.pem).
The correct answer is in another article (which is not so easily found because it refers to a different error message): One has to set the custom_cacert_pem option in the [General] section of Matomo’s config.ini.php.
In my case, I am running Matomo inside a Docker container that is based on Alpine Linux and I have added our internal root CA to the root CA bundle used by most programs in Alpine, so I use the following setting:
[General] custom_cacert_pem = "/etc/ssl/certs/ca-certificates.crt"