All Categories > ​Web Hosting ​ > ​ ​WordPress > How to fix the "cURL error 60: SSL certificate problem" WordPress issue

How to fix the "cURL error 60: SSL certificate problem" WordPress issue

Updated 3 days ago by Jordan Jones

When your WordPress site makes an outgoing request - checking for updates, calling an API - it verifies the other end's SSL certificate against a list of trusted authorities that WordPress ships with. If that list still contains the DST Root CA X3 certificate, which expired on 30 September 2021, those requests can fail.

This is about the list your site uses, not the certificate your site serves - it happens regardless of who issued your own SSL certificate. It affects:

  • WordPress core updates
  • Plugin updates
  • Any plugin using WordPress's HTTP API

Plugins that make their own connections rather than going through WordPress - TinyPNG is one, and it ships its own certificate list - are not fixed by anything below. Update the plugin instead.

Error message

cURL error 60: SSL certificate problem: certificate has expired

If your error ends with unable to get local issuer certificate instead, that is a different fault with a different cause - the steps below will not fix it, so please open a ticket and quote the full message.

Fixes

Option 1: Update WordPress

The expired certificate was removed from WordPress in version 5.8.2 (November 2021) and every version since, so updating to the current release fixes it in most cases. If you're unable to update WordPress through the admin dashboard, you may instead reinstall the core WordPress files through CLI which will update your installation. See our guide to reinstalling WordPress with WP-CLI.

Option 2: Manual Fix (if updating in option 1 fails)

If the WordPress update is still failing, you can replace the certificate list by hand.

This is a temporary measure. The file you are about to edit is part of WordPress itself, so the next WordPress update - including an automatic one - will replace it and the problem may come back. Do it in this order: try Option 1 first, and only fall back to this. In particular, the WP-CLI reinstall linked above will overwrite this change, so do not run it afterwards.
  1. Download the latest certificate bundle:
    1. Visit: https://curl.se/ca/cacert.pem
    2. Save the file to your computer
  2. Replace WordPress certificate file:
    1. Navigate to /wp-includes/certificates/ca-bundle.crt on your hosting service file manager. If needed, see our guide to using the cPanel File Manager.
    2. Replace the contents with the downloaded cacert.pem content
    3. Done!

Test it works

Try updating a plugin or check for WordPress updates. The errors should be gone.

Still not working?

If both options fail, the expired certificate may be in the server's own trust store rather than WordPress's - which is not something you can change from File Manager. Open a ticket with the full error message and the site it happens on, and we will take a look.

How did we do?

Powered by HelpDocs (opens in a new tab)
© Krystal Hosting Ltd 2002–