What PHP CURL OpenSSL version are you using?

you can see this in phpinfo() output such as this:

Hi, thanks for your reply!

This is the output:

@mr-manuel I'm not sure what the problem is, but could you try upgrade your CURL version as it's quite old. It may work better with your SSL certificate?

Hi, now I asked my hoster to update CURL. This might take a while. Thanks

Hi again, now they told me that I can change by myself the "ca-certificates.crt" file.
I found a recent one on https://curl.haxx.se/docs/caextract.html but the extension is *.pem.
I tryed to convert the *.pem to *.crt with the command openssl x509 -outform der -in cacert.pem -out cacert.crt but I get only a file that is about 889 bytes? Thanks for helping!

Now by chance I rechecked my certificate and find out, that I didn't have inserted the CA bundle on the webserver. After inserting CA bundle from my certificate all works fine. Sorry for inconvenience and thanks for your patience!

Now by chance I rechecked my certificate and find out, that I didn't have inserted the CA bundle on the webserver. After inserting CA bundle from my certificate all works fine. Sorry for inconvenience and thanks for your patience!

@mr-manuel What do you mean by this, could you maybe write the steps you took here, as it could help other users with the same issue? Thanks!

Sure :)
I checked the certificate via command line: curl -vvI https://piwik.mydomain.sample

The output was following:

* About to connect() to piwik.mydomain.sample port 443 (#0)
*   Trying 37.xxx.xxx.xxx...
* connected
* Connected to piwik.mydomain.sample (37.xxx.xxx.xxx) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS alert, Server hello (2):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection #0
* SSLv3, TLS alert, Client hello (1):
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option.

So I checked in my webhoster dashboard the SSL certificate for piwik.mydomain.sample and saw that the field for the ca-bundle code was empty. I pasted in the code which I got from the CA Authority and a few minutes later all worked :)

Hope that this can also help others

Thanks @mr-manuel

I pasted in the code which I got from the CA Authority and a few minutes later all worked :)

Is the code you refer to, similar to our list of cacert.pem? https://github.com/piwik/piwik/blob/master/core/DataFiles/cacert.pem

No the code is not similar. The code is from the *.ca file you get, when you buy a certificate.