cURL error 60 SSL in WordPress – how to fix it [Guide]

Download failed. cURL error 60: SSL certificate – how to fix in WordPress

Error cURL error 60: SSL certificate problem: unable to get local issuer certificate appears in WordPress usually when trying to install or update plugins, themes or the WP core itself – that is, everywhere WordPress connects via HTTPS to an external server (e.g. api.wordpress.org).

What exactly does this error mean

Code 20 in OpenSSL (unable to get local issuer certificate) means that the server cannot verify the SSL certificate chain of the target page because the local file with trusted root certificates (CA bundle) is outdated, corrupted or not specified in PHP/cURL configuration at all. This is not a problem with the certificate of the page that WordPress is trying to query – the problem lies on your server side.

Solution 1: update ca-bundle.crt in WordPress

WordPress keeps its own copy of root certificates in the file wp-includes/certificates/ca-bundle.crt. This is the first place to check.

1. Download the current file from the latest version of WordPress (latest ZIP archive from wordpress.org or directly from the WordPress Core repository on GitHub).
2. Replace the file on the server via FTP/SFTP or hosting panel at the location wp-includes/certificates/ca-bundle.crt.
3. Set permissions 644 on the file.
4. Clear any object cache (Redis/Memcached) and try again.

Solution 2: updating the CA bundle at the server level (system/PHP)

If replacing the WP file doesn't help, the problem lies in the configuration of the server itself — that is, in the system cURL/OpenSSL, which PHP uses regardless of WordPress files.

On Linux servers (Debian/Ubuntu):

sudo apt update sudo apt install --reinstall ca-certificates sudo update-ca-certificates

On CentOS/AlmaLinux/RHEL servers:

sudo yum reinstall ca-certificates sudo update-ca-trust

Manual update of cacert.pem for PHP

If you don't have root access to the system (typical shared hosting), download the current file cacert.pem directly from curl.se:

Download cacert.pem

Upload it to the server (e.g. to a directory outside public_html, so it's not publicly accessible) and specify it in php.ini:

curl.cainfo = "/path/to/cacert.pem" openssl.cafile = "/path/to/cacert.pem"

After changing php.ini restart PHP-FPM or Apache, depending on your configuration:

sudo systemctl restart php8.2-fpm sudo systemctl restart apache2

Solution 3: when using HestiaCP or your own VPS

When managing your own server, it's worth checking two additional things:

• OpenSSL version — if the system is old (e.g. Ubuntu 18.04 coming out of support), just upgrading ca-certificates may not be enough, because newer root certificates are missing from the repositories. In that case, only a system update or manual upload helps cacert.pem.
• Separate PHP versions for different domains — if you host multiple sites with different PHP versions, make sure curl.cainfo is set for the correct PHP-FPM version, because each version has its own php.ini.

How to verify that the problem has been resolved

From the server level, you can check the SSL connection directly via cURL in the terminal:

curl -v https://api.wordpress.org/

If no error appears in the log unable to get local issuer certificate, the configuration is already correct and WordPress should be able to download updates again without any problems.

Additionally, it's worth checking from the PHP level which CA file is actually being used:

<?php
var_dump(ini_get('curl.cainfo'));
var_dump(ini_get('openssl.cafile'));

Summary

cURL error 60 in WordPress is in most cases a matter of an outdated root certificate file, not a failure of WordPress itself.