PECL Behind a Proxy: Configure the CLI PHP CA Bundle

Set the PEAR downloader route, then inspect the CLI PHP configuration behind a certificate failure instead of editing the web server's php.ini.

For a PECL installation using PEAR's shared downloader configuration, set its proxy, using your HTTP endpoint or a candidate from the HTTP proxy list for permitted public package downloads:

pear config-set http_proxy http://proxy.example:8080

If the next failure is certificate verification, follow the PHP binary actually launching PECL. Ask that binary which files it loads:

php --ini

Use its explicit executable path if it differs from the shell's php. The website's PHP process can read another php.ini.

In the CLI's applicable OpenSSL stream configuration, name the approved bundle:

openssl.cafile=/path/to/approved-ca-bundle.pem

Keep peer and hostname verification enabled. The bundle must trust the verified peer, including the organization's approved CA when its inspection arrangement requires it.

The executable-to-loaded-file chain determines whether the edit reaches this downloader. A valid CA file configured in another PHP installation leaves PECL's failure unchanged.

Artiglyn mynjee