Fix Download Failed cURL Error 60 SSL Certificate OpenSSL Verify Result Unable to Get Local Issuer Certificate (20)

Learn how to fix Download failed cURL error 60 SSL certificate OpenSSL verify result unable to get local issuer certificate in WordPress.

Fix Download Failed cURL Error 60 SSL Certificate Error

If you’re seeing the following error while updating WordPress, installing plugins, downloading themes, connecting to an external API, or using WP-CLI, don’t worry. This is one of the most common SSL-related errors in WordPress and PHP.

 Download failed.: cURL error 60: SSL certificate:
OpenSSL SSL_connect: SSL_ERROR_SYSCALL

or

Download failed.: cURL error 60:
SSL certificate problem:
unable to get local issuer certificate

OpenSSL verify result:
unable to get local issuer certificate (20) 

This error usually means your server cannot verify the SSL certificate of the remote website because the required Certificate Authority (CA) bundle is missing, outdated, or incorrectly configured.

In this guide, you’ll learn multiple methods to fix the Download failed cURL error 60 permanently.

What Causes cURL Error 60?

The error appears when cURL tries to establish a secure HTTPS connection but cannot verify the SSL certificate.

Common causes include:

Missing CA certificate bundle
Outdated CA bundle
Incorrect PHP configuration
Expired server certificates
Incorrect system date and time
Firewall or proxy interference
Hosting provider misconfiguration
Old PHP or OpenSSL version

Method 1. Disable SSL Verification (Temporary Fix)

If you’re testing locally or need a quick workaround, you can disable SSL verification inside WordPress.

Add the following code to your theme’s functions.php file or a custom plugin.

add_filter('https_ssl_verify', '__return_false');

This tells WordPress to skip SSL certificate verification during HTTPS requests.

Sometimes developers also use:

add_filter('https_local_ssl_verify', '__return_false');

define('WP_HTTP_BLOCK_EXTERNAL', false);

Important

This is not recommended for production websites because it reduces security by disabling SSL verification.

Only use it for troubleshooting. Once the actual SSL problem is fixed, remove the code immediately.

Method 2. Update the CA Certificate Bundle

The most common solution is updating your server’s CA certificates.

For Ubuntu:

sudo apt update sudo apt install ca-certificates
sudo update-ca-certificates

For CentOS:

sudo yum update ca-certificates

For AlmaLinux or Rocky Linux:

sudo dnf update ca-certificates

Restart Apache or Nginx after updating.

Method 3. Configure PHP to Use the Correct CA Bundle

Sometimes PHP doesn’t know where your CA certificates are located.

Open your php.ini file.

Find these lines.

 curl.cainfo=
openssl.cafile= 

Update them like this.

Windows example:

 curl.cainfo="C:\php\extras\ssl\cacert.pem"
openssl.cafile="C:\php\extras\ssl\cacert.pem" 

Linux example:

 curl.cainfo=/etc/ssl/certs/ca-certificates.crt
openssl.cafile=/etc/ssl/certs/ca-certificates.crt 

Save the file and restart your web server.

Method 4. Download the Latest cacert.pem File

If your server doesn’t include CA certificates, download the latest cacert.pem file.

Place it somewhere like:

C:\php\extras\ssl\

/etc/ssl/certs/

Then point curl.cainfo and openssl.cafile to the new file.

Method 5. Update PHP

Older PHP versions often include outdated SSL libraries.

Check your version.

php -v

Upgrade to a supported PHP version such as:

PHP 8.2
PHP 8.3
PHP 8.4 (if supported by your hosting)

After upgrading, restart PHP-FPM or Apache.

Method 6. Update OpenSSL

Verify your OpenSSL version.

openssl version

If it’s outdated, update it using your operating system’s package manager.

An outdated OpenSSL library may fail to validate newer SSL certificates.

Method 7. Verify the Website SSL Certificate

Sometimes the problem isn’t your server.

The remote website may have:

Missing intermediate certificates
Expired SSL certificate
Invalid certificate chain
Self-signed certificate

You can test the website using your browser or online SSL testing tools.

If the remote certificate is invalid, only the website owner can fix it.

Method 8. Check Server Date and Time

SSL certificates rely on accurate timestamps.

Check your server time.

Linux:

date

If the date or timezone is incorrect, synchronize it.

timedatectl set-ntp true

Method 9. Restart PHP and Web Server

Configuration changes won’t take effect until services restart.

Apache

sudo systemctl restart apache2

Nginx

 sudo systemctl restart nginx
sudo systemctl restart php-fpm 

LiteSpeed

sudo systemctl restart lsws

Method 10. Contact Your Hosting Provider

If none of the above solutions work, ask your hosting provider to check:

CA certificate installation
OpenSSL configuration
PHP cURL configuration
Firewall restrictions
Outdated operating system packages
SSL certificate chain

Most managed hosting providers can resolve this within minutes.

How to Test if the Problem Is Fixed

Run:

curl https://example.com

Or check inside WordPress by:

Installing a plugin
Updating a plugin
Updating a theme
Running WP-CLI commands
Using the WordPress Site Health tool

If no SSL errors appear, the issue has been resolved.

Common cURL Error 60 Messages

You may encounter any of these variations.

Download failed cURL error 60
SSL certificate problem unable to get local issuer certificate
OpenSSL verify result unable to get local issuer certificate (20)
cURL error 60 SSL certificate problem
certificate verify failed
SSL peer certificate cannot be authenticated
Failed to enable crypto
Unable to establish secure connection

All of these generally point to SSL certificate validation problems.

Best Practices to Prevent cURL Error 60

Keep PHP updated
Keep OpenSSL updated
Update CA certificates regularly
Use trusted SSL certificates
Renew certificates before expiration
Keep your operating system updated
Restart services after configuration changes
Avoid disabling SSL verification permanently

Frequently Asked Questions

Can I permanently use add_filter('https_ssl_verify', '__return_false');?

No. It should only be used temporarily while troubleshooting because it disables SSL certificate verification and weakens security.

Does reinstalling WordPress fix cURL error 60?

No. The issue is usually related to the server, PHP, OpenSSL, or CA certificates—not the WordPress core files.

Can Cloudflare cause cURL error 60?

Rarely. Cloudflare usually works correctly, but if the origin server has an invalid certificate chain or SSL configuration, cURL may fail.

Can an expired SSL certificate trigger this error?

Yes. If either your server or the remote website has an expired SSL certificate, cURL may refuse the connection.

Can shared hosting cause this problem?

Yes. Some shared hosting providers use outdated CA bundles or incorrect PHP configurations, resulting in cURL error 60.

Conclusion

The Fix Download failed cURL error 60 issue is almost always caused by SSL certificate verification problems rather than WordPress itself. While adding:

add_filter('https_ssl_verify', '__return_false');

can temporarily bypass the error, it should never be considered a permanent solution.

The safest approach is to update your CA certificates, configure PHP correctly, keep OpenSSL and PHP updated, and ensure the remote website has a valid SSL certificate. Following the methods above will resolve the vast majority of Download failed cURL error 60 SSL certificate issues while maintaining a secure WordPress installation.