How to fix cURL error 60: SSL certificate problem on WordPress 5.8.1 and below
Due to LetsEncrypt’s Root Certificate expiring on 30th September 2021, quite a number of users started experiencing SSL related issues.
I use WP Rocket and OMGF for enhancing Core Web Vital scores – after setting up a new site yesterday (just a little over 24 hours after Lets Encrypt’s certificate had expired), I was unable to activate WP Rocket, nor could I use OMGF to scan the site.
On this site which also uses WP Rocket, I was also unable to generate Critical CSS, with the same error message “Critical CSS for front_page not generated. Error: cURL error 60: SSL certificate problem: certificate has expired”
Going back to the previous site, running WP_REMOTE_GET also returned “cURL error 60: SSL certificate problem: certificate has expired.”. However using cURL directly via SSH did not produce any problems.
After hours of head scratching, testing and blaming our hosting provider for using OpenSSL 1.0.2, our hosts over at 20i pointed out a new ticket on WordPress Trac – https://core.trac.wordpress.org/ticket/54207 where they were getting errors such as “WP HTTP API Error: cURL error 60: SSL certificate problem: certificate has expired.”
It seems that WordPress loads its own CA Bundle, which contains the expired certificate.
According to user bradleyt:
The wordpress /wp-includes/certificates/ca-bundle.crt file still contains this expired certificate. Removing this DST Root CA X3 section resolved the SSL errors we were seeing in our logs.
After editing the ca-bundle.crt file and removing the DST Root CA X3 certificate, WP Rocket was suddenly activated, and OMGF was able to scan for Google Fonts on the front end of our site. Hooray!
How to fix
The fix is very simple:
- Download and edit the ca-bundle.crt file found in /wp-includes/certificates/ using your preferred text editor (I use notepad++)
- Do a search for “DST Root CA X3” or scroll down to line 739 (assuming you are using the currently latest version of WordPress 5.8.1)
- Remove the entire certificate (approx 19 lines including the DST Root CA X3 title)
- Save and re-upload to /wp-includes/certificates/ overwriting the original
- Go back on your site, and check – your plugins should now be working
Alternatively, download the fixed version here and overwrite the current version in /wp-includes/certificates/ : https://drive.google.com/file/d/1uJQCXJK758K7rcB1VkfmJttI48bBJR-v/view?usp=sharing
This fix should apply to users of WordPress 5.8.1 and below, although for older versions, the exact line that DST Root CA X3 appears may differ.
WordPress 5.8.2 should fix this problem.
Thanks works fine
Omg! Finally a fix that works! I thank you a lot. All other solutions on stackoverflow and co did not work or were not as foolproof described as here. I spent hours trying to find this fix. Thank god I found this post here through a Facebook group. I never thought it was because of WordPress and Lets Encrypt. Thank you a lot!!
Better solution to do this is using WordPress hook and not touch core files.
How to do this in details described here: https://wp-kama.com/note/error-making-request-wordpress
Under normal circumstances, I’d agree, it would also be my preferred method 99% of the time, however this is more of a quick fix aimed at less technical users using standard WordPress installations (so not Bedrock or headless sites etc). It’s a change that you can forget about, as it will be overwritten in the next update with the (hopefully) fixed version.
Works fine for Oxygen Builder updating
Well, I replaced it with the original file after the test failed.
Unfortunately, it does not work for me.
Hi Mario, I checked your website (when hovering over your username, it shows the URL) and that appears to be loading the unfixed ca-bundle.crt file. If it’s another site, can you provide the URL to it please?
Hi there
thanks for you commitment, it saved me hours of useless attempts
This fixed the WP Rocket issue
Best