ca-bundle

composer/ca-bundle is a small PHP utility library that locates a usable CA certificate bundle for TLS verification. It probes the common system CA locations across operating systems and, if none is found, falls back to a bundled copy of the Mozilla CA bundle.

Originally extracted from Composer itself, it also provides helpers to validate a CA file and to detect whether PHP’s openssl_x509_parse can be used safely, making it a reliable building block for any code that needs to make verified HTTPS connections via curl or stream contexts.

What You Get

• CaBundle::getSystemCaRootBundlePath() to locate the system CA bundle with fallback
• CaBundle::getBundledCaBundlePath() returning the packaged Mozilla CA file
• CaBundle::validateCaFile() to validate a CA file safely
• CaBundle::isOpensslParseSafe() to check whether openssl_x509_parse is safe to use
• A bundled Mozilla CA bundle for environments without system certificates

Common Use Cases

• Configuring CURLOPT_CAINFO/CAPATH for verified HTTPS curl requests
• Setting the cafile for PHP stream context SSL options
• Ensuring TLS verification works across Linux, macOS, and Windows
• Providing certificates in minimal or containerized environments

Under The Hood

Architecture - The library centers on a single Composer\CaBundle\CaBundle class in src/. getSystemCaRootBundlePath() checks environment variables and a prioritized list of well-known OS certificate paths, validates candidates, and returns the first usable one - otherwise falling back to the packaged Mozilla bundle under res/. Results are cached statically and can be cleared with reset(). Tech Stack - Pure PHP (^7.2 || ^8.0) requiring the openssl and pcre extensions, with no runtime dependencies; the packaged res/cacert.pem provides the Mozilla fallback. Dev tooling includes PHPUnit and PHPStan. Code Quality - The repository ships a PHPUnit test suite and a PHPStan (level) configuration, is actively maintained by the Composer team, and battle-tested through Composer’s own enormous install base; the small, well-scoped code is easy to audit. API Design - The public surface is a handful of clearly named static methods, so integrating verified TLS is typically a one-line call feeding curl or a stream context; the README documents each method with copy-paste examples, giving a very low learning curve.