WordPress cURL Error 60: Fix Certificate Trust, Not Verification

cURL error 60 means certificate verification failed during a connection. In WordPress it may appear while contacting an update service, payment provider or another API. It does not automatically mean your website's own HTTPS certificate is broken: first identify the destination WordPress was trying to reach.

Find the failing request

Record the destination hostname, complete error message and affected operation. Remove tokens and customer data before sharing logs. If only one remote service fails, investigate its certificate chain and hostname. If many unrelated destinations fail, the server's clock, trust store or an intercepting proxy deserves closer attention.

A browser on your laptop succeeding is useful evidence, but not proof that PHP on the hosting server trusts the same certificates. Likewise, command-line curl and web-served PHP may use different TLS backends or CA settings. The curl certificate guide explains these trust-store differences.

Check the environment handling the request

• Confirm that the server's date and time are correct.
• Identify the PHP runtime used by the site, not just the default command-line version.
• Check which configuration file and CA bundle that runtime actually loads.
• Ask whether an approved outbound proxy inspects HTTPS connections.

Use a hosting diagnostic facility or an administrator-controlled check. Do not leave a public PHP information page available after troubleshooting. On managed hosting, the provider may need to repair the system certificate package or PHP configuration.

Repair the appropriate trust source

If the remote server omits an intermediate certificate, its administrator should correct the served chain. If the local CA package is outdated or inaccessible, update it through the supported operating-system or hosting mechanism. For an intentional private certificate authority, trust the approved CA through the appropriate managed configuration rather than downloading an arbitrary certificate file from a forum.

WordPress adds another detail: its HTTP API has an sslcertificates option and normally supplies a WordPress CA bundle. Therefore, changing PHP's curl.cainfo setting is not a universal fix for every WordPress request. Check the plugin's actual request path and the WordPress HTTP request options before assuming which bundle is used.

Repeat the original operation

After the targeted correction, retry the failing update or API call and inspect its result. Keep certificate and hostname verification enabled. A global filter that disables SSL verification may hide the error while removing an important identity check for unrelated requests too. If the request still fails, provide the hosting administrator with the destination, runtime details and sanitized error rather than stacking more bypasses.