WORDPRESS : cURL error 60: SSL certificate

Question

I'm currently building a Wordpress install under a debian server. I install PHP7, curl and Apache2

While I'm trying to install new extension I have this error message :

cURL error 60: SSL certificate problem: self signed certificate in certificate chain

I try to modify the php.ini with this, after reading some post treating similar issue :

curl.cainfo = /etc/php7.0/cacert.pem

But I'm still facing the problem even with restart apache.

Any ideas ?

Thanks in advance

Possible duplicate of [Curl error 60, SSL certificate prðblem: self signed certificate in certificate chain](https://stackoverflow.com/questions/21187946/curl-error-60-ssl-certificate-pr%c3%b0blem-self-signed-certificate-in-certificate-c) — modsfabio, Jun 19 '17 at 14:08

score 16 · Answer 1 · answered Jul 25 '21 at 17:32

Disable SSL verification within your testing site.

You can do this by adding this line into the file

Appearance > Theme Editor > functions.php or

/wp-content/themes/YOUR_THEME/functions.php:

add_filter('https_ssl_verify', '__return_false');

Only add this on a testing site, never on a live site.

score 14 · Answer 2 · answered Feb 20 '19 at 11:15

14

set 'sslverify' to false to fix the cURL error 60: SSL certificate in WordPress wp_remote_get request.

wp_remote_get($url, array('sslverify' => FALSE));

answered Feb 20 '19 at 11:15

Fasil Palanthodi

187
1
6

4

Where to add this? – Manik Arora Dec 24 '20 at 07:10
Very nice solution! it solved me the problem! Brilliant! – David Apr 22 '21 at 07:07

score 5 · Answer 3 · answered Sep 19 '19 at 06:25

5

WordPress uses it's own CA bundle, located in WP/wp-includes/certificates.

The CA bundle that was shipped with WordPress up until recently was outdated, as discussed in this issue: https://core.trac.wordpress.org/ticket/45807.

Setting sslverify to false is not recommended, and instead you can download an updated version of the bundle, https://github.com/WordPress/WordPress/tree/master/wp-includes/certificates and replace it in the wordpress folder.

answered Sep 19 '19 at 06:25

Michael

339
3
12

1

The CA bundle from the Github link you stated did not work for me (restarted local apache and everything). Only settings 'sslverify' => FALSE did... – Styledev Oct 24 '20 at 21:25

score 4 · Answer 4 · answered Jun 14 '18 at 13:56

Based on my recent experience, I believe that the message "self signed certificate in certificate chain" tells you the issue exactly - which is that whichever SSL site you are trying to access has a certificate in the chain that is not in the bunch that is referenced by cacert.pem.

This makes sense because the error reports that it is a self-signed certificate.. i.e. It would never be included in the downloaded cacert.pem file.

My solution was to get a Base64 encoded file containing the certificate chain of the site that I am trying to access.

    How to: Use a browser to access the site you are trying to access, click the 
    certificate part of the address (usually to the left of the address box with 
    a lock icon) and the click on whatever your interface supports to see the 
    list of certificates in the chain.  Manually export those certificates to a 
    text file.

Then append this text file with a text editor to the list of certificates (cacert.pem) that PHP is using for CURL actions.

You mention WordPress.. WordPress v4.9.6 has a bundle of certificates that it specifically references when it is upgrading or installing plugins at ./WordPress Instance\wp-includes\certificates. My stop-gap solution was to append the text file above (containing the local self signed-certificate chain) to the ca-bundle.crt file that you will find in that location.

One caveat - when you upgrade WordPress it will overwrite the ca-bundle.crt file, so you will have to re-add them - unless someone has a better solution..?

This exactly is what worked for me. I knew the issue was it being self-signed, I just didn't know how to convince WordPress that this was okay. Your solution was the only one that worked. For anyone who is having this issue on a local install of WordPress, this is the solution. — Olandir, Jun 28 '21 at 20:37

Fery W · Answer 5 · 2020-06-07T20:07:45.850

In case someone come across same issue with their WordPress installation on Local Machine, by adding http_request_args filter did the trick for me

<?php
/**
 * Plugin Name: Local Dev CaFile
 * Plugin URI: https://stackoverflow.com/q/44632619/881743
 * Description: Another solution for `SSL certificate problem: self signed certificate in certificate chain apache` error for your local development
 * Version: 1.0
 * Author: John Doe
 * Author URI: https://stackoverflow.com/
 * License: WTFPL
 */

add_filter( 'http_request_args', function ( $args ) {
    if ( getenv('WP_ENV') !== 'development' ) {
        return $args;
    } 

    $args['sslcertificates'] = ini_get( 'curl.cainfo' ) ?? $args['sslcertificates'];

    return $args;
}, 0, 1 );

and save it in path/to/wp-content/plugins/dev-plugin.php and activate the plugin from wp-admin, or optionally you could put it in your WPMU_PLUGIN_DIR.

Hope that helps Cheers

score 1 · Answer 6 · answered Jun 19 '17 at 14:07

1

Download this file http://curl.haxx.se/ca/cacert.pem

Use your file's location in openssl.cafile=c:/cacert.pem

Reference - https://github.com/auth0/auth0-PHP#i-am-getting-curl-error-60-ssl-certificate-problem-self-signed-certificate-in-certificate-chain-on-windows

answered Jun 19 '17 at 14:07

Ganesh

3,128
2
17
27

@Nathan30 wordpress version? – Ganesh Jun 19 '17 at 14:20
Latest Wordpress 4.8 – Nathan30 Jun 19 '17 at 14:23
@Nathan30 Just download the 4.7.5 version of wordpress & copy /wp-includes/certificates/ca-bundle.crt to your server. Keep backup of your old file too. – Ganesh Jun 19 '17 at 14:25
Did it, and still remain the same problem :/ – Nathan30 Jun 19 '17 at 14:30
Where do I have to put it ? ON which wordpress file ? – Nathan30 Jun 19 '17 at 14:42
@Nathan30 got no leads man. May be try reinstalling Wordpress. If you find any solution please update me too. Thanks. – Ganesh Jun 19 '17 at 14:46

score 1 · Answer 7 · answered Oct 04 '21 at 14:15

1

Upgrade from wp-cli 2.4 => 2.5 helped me. (with installing this https://github.com/wp-cli/profile-command )

answered Oct 04 '21 at 14:15

vosykapavel

21
3

score 1 · Answer 8 · answered Oct 18 '21 at 06:17

None of the answers here worked for me (and may not work for people using Let's Encrypt certificates on their servers). I found that recently (Sept 30,2021 ) the Let's Encrypt Cretificates expired DST Root CA X3. In addition to the curl error 60 I also had Rest API errors and inability to updated plugins in wordpress. It is possible to update these in the wordpress installation:

The patch is available here and should be available with Wordpress 5.9 (December 2021) if not earlier: https://core.trac.wordpress.org/changeset/51883/trunk/src/wp-includes/certificates/ca-bundle.crt

score 0 · Answer 9 · answered Aug 26 '22 at 01:42

For Wordpress you can use like this:

$url = "YOUR_ENDPOINT";
$args = array(
        'headers' => array(
            'Authorization' => 'HASH_HERE'
        ),
        'sslverify' => FALSE,
        'data' => array(
            'campaign_id' => $campaign_id
        )
    );

$response = wp_remote_get($url, $args);
$body     = wp_remote_retrieve_body($response);

score 0 · Answer 10 · answered Sep 14 '22 at 15:59

I had this issue recently because our network does the ssl proxy trick. We had a custom CA bundle that included our internal cert. That was bundled up in the /etc/pki folders, so I just symlinked to it: ln -s /etc/pki/tls/certs/ca-bundle.crt /wp-includes/certificates/

Now it stays updated whenever I update the system.

WORDPRESS : cURL error 60: SSL certificate

10 Answers10