Maintaining a secure connection between your WordPress environment and external APIs is a fundamental requirement for modern web development. When your server attempts to communicate with an external service via PHP cURL, it performs an SSL/TLS handshake to verify the identity of the remote host. If this handshake fails, the operation is aborted, and the system typically returns a cURL error 60. This specific error code indicates that the local server cannot verify the authenticity of the SSL certificate provided by the remote server, often due to an outdated or missing Certificate Authority bundle.
The error message usually reads something like cURL error 60: SSL certificate problem: unable to get local issuer certificate. This occurs because the cURL library on your server relies on a file named cacert.pem, which serves as a trusted database of certificate authorities. If this file is missing or contains expired root certificates, your WordPress installation will be unable to establish a secure connection, leading to issues with plugin updates, API integrations, and email delivery services.
Understanding the Mechanics of cURL Error 60
What triggers the SSL certificate verification failure?
The primary driver behind this error is a mismatch between the server environment and the security requirements of modern web services. When a PHP script makes an outbound request to an HTTPS URL, the cURL library checks the remote server certificate against a local list of trusted root certificates. If your server is running an older distribution or a custom PHP build where the CA bundle has not been updated in years, it will fail to recognize newer, legitimate certificates.
This situation is common on shared hosting environments or older VPS setups that have not received system-level updates. It is important to note that this is not necessarily a sign of a compromised server. Instead, it acts as a security safeguard; the system is refusing to establish a connection because it cannot verify the integrity of the recipient, thereby preventing potential man-in-the-middle attacks. Resolving it requires updating the trust chain rather than disabling the security checks.
The role of the cacert.pem file in PHP environments
The cacert.pem file is essentially a text-based repository containing public keys from trusted Certificate Authorities. Every time a secure request is initiated, cURL reads this file to validate the chain of trust for the target website. If the path to this file is misconfigured in your php.ini file, or if the file itself is corrupted or outdated, the validation process will default to an error state.
In many production environments, this file is managed by the operating system package manager, such as apt or yum. However, on Windows-based servers or specific Docker containers, you may be required to maintain this file manually. Understanding whether your server uses a system-wide path or a local path is critical for applying the correct fix, as attempting to overwrite system files without proper permissions can lead to broader infrastructure stability issues.
Step-by-Step Guide to Updating cacert.pem
Downloading the latest CA bundle from Mozilla
The most reliable way to obtain a fresh copy of the root certificates is through the official source maintained by the Mozilla project. The curl.se website provides a curated version of this bundle that is formatted specifically for use with cURL. You should navigate to the official website and download the latest cacert.pem file to your local machine before transferring it to your server via SFTP or SCP.
Once downloaded, you must place the file in a secure, non-public directory on your server. Avoid placing this sensitive file inside your public_html or webroot directories, as this could lead to unauthorized access. A common practice is to store it in /etc/ssl/certs/ or a dedicated directory within your PHP configuration path. Ensure that the file permissions are set to 644 so that the web server user has read access but not write access.
Configuring php.ini to recognize the new certificate path
After uploading the file, you must instruct PHP to use it for all cURL operations. This is done by modifying the php.ini configuration file. Locate the [curl] section within your php.ini. If you do not see this section, you may add it manually. Within this section, you need to define the path to the certificate file using the curl.cainfo directive.
The syntax should look like this: curl.cainfo = "/path/to/your/downloaded/cacert.pem". After updating the path, you must restart your web server software—such as Apache, Nginx, or PHP-FPM—for the changes to take effect. You can verify the success of this change by creating a simple PHP script that runs phpinfo() and searching for the curl.cainfo value to ensure it matches the path you just defined.
Troubleshooting Common Configuration Pitfalls
Permissions and ownership issues
Even after placing the file and updating the configuration, you might find that the error persists. This is often due to the web server process lacking the necessary permissions to access the file. In a Linux environment, ensure that the file is owned by the root user, but readable by the group under which your web server runs, such as www-data or apache.
Running a quick check with the command ls -l /path/to/cacert.pem will reveal the current ownership. If the web server user cannot read the file, cURL will silently fail to load the certificate store, defaulting back to the error state. Adjusting these permissions is a simple but frequently overlooked step in the deployment process.
Verifying PHP environment settings
Sometimes, multiple php.ini files exist on a single server, such as one for the CLI and one for the web server (FPM). If you update the file via the command line but the error persists on your website, you may have updated the wrong configuration file. Use the php --ini command to identify which configuration files are currently loaded by the CLI, and check your web server dashboard or a phpinfo file to see which one is loaded by the web process.
| Potential Issue | Root Cause | Resolution |
|---|---|---|
| Wrong File Path | Incorrect path in php.ini | Verify absolute path in phpinfo() |
| File Permissions | Web user cannot read file | chmod 644 cacert.pem |
| Cached Configuration | Server not restarted | Restart PHP-FPM or Apache |
Advanced Considerations for Managed Hosting
When to contact your hosting provider
If you are on a managed shared hosting plan, you likely do not have root access to modify server-wide configurations or restart the server process. In such cases, attempting to edit php.ini might result in a permissions error. If you encounter cURL error 60 on a managed server, the first step should be to open a support ticket with your hosting provider. They are responsible for keeping the server-side CA bundles up to date.
Provide them with the specific error log from WordPress and explain that your outbound requests are failing due to an outdated certificate store. A competent hosting provider will resolve this by updating the system-level libraries, which is a safer and more permanent solution than trying to hack a local file path into your individual account configuration.
Using environment variables in containerized setups
For users running WordPress in Docker containers, the approach differs significantly. You should not be manually editing files inside the container. Instead, you should map a volume that contains the updated cacert.pem file into the container at runtime. By using environment variables or modifying the Dockerfile to include the latest certificates during the build process, you ensure that your environment remains consistent and reproducible.
Conclusion
Resolving WordPress cURL error 60 is a matter of ensuring your server’s trust database is current and correctly referenced by your PHP configuration. By downloading the latest Mozilla CA bundle, placing it in a secure location, and pointing your php.ini file to that directory, you can eliminate SSL handshake failures. While the process requires careful attention to file paths and server permissions, it is a standard maintenance task that restores functionality to your site's external communications and enhances overall security.
Frequently Asked Questions
Is it safe to ignore cURL error 60?
No, you should never ignore this error. Disabling SSL verification to bypass the error exposes your site to man-in-the-middle attacks, where malicious actors could intercept or modify data transmitted between your server and external APIs.
Do I need to update the cacert.pem file frequently?
You should aim to update this file once or twice a year. Certificate Authorities frequently update their root certificates, and using an outdated bundle may eventually lead to connection failures with new services.
Why does my local development environment show this error?
Local environments like XAMPP or MAMP often come with outdated versions of cURL and certificate bundles. Updating the bundle manually in your local php.ini is the standard way to resolve this issue during development.
Can this error affect WordPress plugin updates?
Yes, WordPress relies on cURL to connect to the WordPress.org API to check for updates. If you have this error, your dashboard will fail to detect new plugin or core updates.
References
- PHP Manual: cURL Options - https://www.php.net/manual/en/function.curl-setopt.php
- Mozilla CA Certificate Store - https://curl.se/docs/caextract.html
- WordPress Developer Resources: Troubleshooting SSL - https://developer.wordpress.org/
