How to fix the cURL error 60 SSL certificate problem in WordPress

When you try to update WordPress, install a plugin or connect to an external service, you may see a message similar to this:

Error en la actualización: Descarga fallida. cURL error 60: SSL certificate problem

The error means that PHP or cURL could not verify the chain of trust of the certificate presented by the remote server. It does not necessarily mean that your own website's certificate has expired.

Possible causes to check

The message fits several scenarios, but it does not let you pick one without further tests:

• An old version of WordPress with an outdated certificate authority bundle.
• The operating system or PHP certificate store is outdated or misconfigured.
• The server date and time are wrong.
• The remote server's certificate has expired, does not match its domain or does not send the full intermediate chain.
• A proxy, antivirus, firewall or security plugin is intercepting the HTTPS connection.

Do not disable SSL verification

Do not use filters that force https_ssl_verify to false.

Disabling verification lets WordPress accept untrusted certificates and makes man-in-the-middle attacks easier. It also hides the real cause and can affect other connections made through the WordPress HTTP API if the filter is applied globally.

1. Check the date and the failing URL

Read the full message to identify the remote domain. If the error appears when updating WordPress, the connection is usually made to api.wordpress.org or downloads.wordpress.org. If it only happens with a particular plugin, it may concern the external service that plugin uses.

Also check that the server date, time and time zone are correct. A large difference can make a valid certificate look expired or not yet valid.

2. Update WordPress, PHP and the certificates

Before changing the configuration:

1. Make a backup.
2. Update WordPress to a compatible, maintained version.
3. Update the plugins and themes involved.
4. Check that the PHP version is still supported.

WordPress includes its own certificate bundle in wp-includes/certificates/ca-bundle.crt. Do not replace just that file with one downloaded from an unknown source: update the whole core so that all its files belong to the same version.

3. Review the PHP certificate configuration

In the PHP information you can check the values of curl.cainfo and openssl.cafile. If they are set, they must point to a certificate file that exists, is readable and is up to date.

From SSH you can also test the connection without disabling any validation:

curl -Iv https://api.wordpress.org/

Test exactly the URL shown in the error. If the command shows the same failure, review the server's certificate store and the chain sent by the destination. If it works from the command line but fails from WordPress, bear in mind that the command line may use a different store: review the configuration of the PHP version that runs the website and log the request from WordPress before blaming a plugin.

4. Rule out interference from plugins and proxies

Only if the log or the configuration points to possible interception, temporarily and in a controlled way disable the security or proxy plugins that could modify outgoing requests. Repeat the same request before and after; the change in result is the useful evidence. Do not run this test in production without a backup and a maintenance window.

If you use a corporate proxy or an antivirus that inspects HTTPS, its certificate authority must be correctly installed in the store PHP uses.

5. Contact the provider when it affects the server

If you do not manage the server, give the provider the remote URL, the full message, the time of the test and the PHP version. They can check the certificate bundle, the cURL/OpenSSL configuration and whether outgoing connections are being intercepted.

The right fix is to restore a valid chain of trust. Disabling SSL verification should not be used, not even as a temporary fix.

If the update cannot be downloaded either

Do not force the download without valid TLS. If you need to update the core manually, use the official distribution, keep a backup first and follow an update procedure compatible with the installed version. Reinstalling the same version and updating are not the same operation.

When you share the failing URL, remove tokens and private parameters. A successful curl from your own computer does not test the hosting's certificate store; collect the test from the environment where the error appears and always tell CLI apart from web PHP.