How to fix cURL error 60: SSL certificate problem on WordPress 5.8.1 and below
Due to LetsEncrypt’s Root Certificate expiring on 30th September 2021, quite a number of users started experiencing SSL related issues.
I use WP Rocket and OMGF for enhancing Core Web Vital scores – after setting up a new site yesterday (just a little over 24 hours after Lets Encrypt’s certificate had expired), I was unable to activate WP Rocket, nor could I use OMGF to scan the site.
On this site which also uses WP Rocket, I was also unable to generate Critical CSS, with the same error message “Critical CSS for front_page not generated. Error: cURL error 60: SSL certificate problem: certificate has expired”
Going back to the previous site, running WP_REMOTE_GET also returned “cURL error 60: SSL certificate problem: certificate has expired.”. However using cURL directly via SSH did not produce any problems.
After hours of head scratching, testing and blaming our hosting provider for using OpenSSL 1.0.2, our hosts over at 20i pointed out a new ticket on WordPress Trac – https://core.trac.wordpress.org/ticket/54207 where they were getting errors such as “WP HTTP API Error: cURL error 60: SSL certificate problem: certificate has expired.”
It seems that WordPress loads its own CA Bundle, which contains the expired certificate.
According to user bradleyt:
The wordpress /wp-includes/certificates/ca-bundle.crt file still contains this expired certificate. Removing this DST Root CA X3 section resolved the SSL errors we were seeing in our logs.
After editing the ca-bundle.crt file and removing the DST Root CA X3 certificate, WP Rocket was suddenly activated, and OMGF was able to scan for Google Fonts on the front end of our site. Hooray!
How to fix
The fix is very simple:
- Download and edit the ca-bundle.crt file found in /wp-includes/certificates/ using your preferred text editor (I use notepad++)
- Do a search for “DST Root CA X3” or scroll down to line 739 (assuming you are using the currently latest version of WordPress 5.8.1)
- Remove the entire certificate (approx 19 lines including the DST Root CA X3 title)
- Save and re-upload to /wp-includes/certificates/ overwriting the original
- Go back on your site, and check – your plugins should now be working
Alternatively, download the fixed version here and overwrite the current version in /wp-includes/certificates/ : https://drive.google.com/file/d/1uJQCXJK758K7rcB1VkfmJttI48bBJR-v/view?usp=sharing
This fix should apply to users of WordPress 5.8.1 and below, although for older versions, the exact line that DST Root CA X3 appears may differ.
WordPress 5.8.2 should fix this problem.