Certificate Pinning with PHP cURL
<p>I see there is tons of post in SO, about error:</p>

<pre><code>SSL certificate problem: unable to get local issuer certificate
</code></pre>

<p>And which is the one I am getting.</p>

<p>All of their answer is just saying download root certificates from: </p>

<p><a href="https://curl.haxx.se/ca/cacert.pem" rel="nofollow">https://curl.haxx.se/ca/cacert.pem</a></p>

<p>And setting into the CURLOPT_CAINFO or setting php.ini's curl.cainfo.</p>

<p>But what this does is actually just telling cURL to trust the list of root CA and their trusted CA.</p>

<p>From my understanding, Certificate Pinning should ignore all these root CA and just trust the single certificate of a particular provider.</p>

<p>What is the correct way to fix this error?</p>

<pre><code>    $ch =  curl_init($url);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);        
    curl_setopt($ch, CURLOPT_CAINFO, '/etc/httpd/static.gc.apple.com.pem');
    curl_setopt($ch, CURLOPT_CAPATH, '/etc/httpd/');

    //curl_setopt($ch, CURLOPT_PINNEDPUBLICKEY, "sha256//TeyzGG/8dvpuksAeSCb3tsvLEHbY6w9q63tXhOIf0Tg=");
    $sslCertificate = curl_exec($ch);
</code></pre>

<p>I know for libcurl itself, it has a option "CURLOPT_PINNEDPUBLICKEY" which do absolutely what I need, but currently PHP still not supporting it... (it doesn't have such constant in PHP and I have no idea what is the actual value of the constant)</p>