Hi Adam
I'm running Blesta 5.4 and Cerb 10.2.5.
http_date was being set successfully by cerb_api.php. I tested that first by setting it to display the output of http_date. I then set curl option for verbose, which showed the cerb-auth header was being sent successfully. The date and time sent by the server matched what http_date was set as.
That's when I checked the Cerb side of the REST API to see what it was validating: https://github.com/jstanden/cerb/blob/10.2.5/features/cerberusweb.restapi/api/App.php
If no X-Date is set in the header, it uses $_SERVER['HTTP_DATE'] to validate the timestamp.
I did some more testing today and it seems like for whatever reason, it is ignoring all header[] lines except the last one, being cerb-auth, and not adding them to the header array (or it is creating a new array each time). This means that the PUT POST etc don't work, as it doesn't add the relevant line to the header. I changed them all to be array_push($header, ...) and it adds them to the header, even though PHP recommends $array[] if adding a single element. Not sure why that is happening, but array_push fixed that.
The http_date issue remains even with array_push. If I add date: $http_date to the header, I get an invalid timestamp error. But X-Date: $http_date works fine. Strange.