How to Fix cURL Error 60 in WordPress: SSL Certificate Problem

When WordPress shows “Update Failed: Download failed. cURL error 60: SSL certificate problem: unable to get local issuer certificate” the server’s certificate authority (CA) bundle is missing or outdated. PHP cannot verify the SSL certificate on the remote download server, so every plugin update, theme download, and WordPress core update fails. The fix depends on your hosting plan: on a VPS or Dedicated server, you can run two commands over Secure Shell (SSH); on Shared or Reseller hosting, InMotion Hosting support applies the fix at the server level.

This is a server-level issue, not a problem with your WordPress installation or your site’s SSL certificate. Your site may load fine over HTTPS but still trigger this error because outbound cURL calls use the server’s CA bundle rather than your site’s certificate.

What Causes cURL Error 60 in WordPress

When WordPress downloads an update, PHP’s cURL library connects to downloads.wordpress.org over HTTPS. Before sending any data, cURL checks that the remote server’s SSL certificate was signed by a trusted certificate authority. That list of trusted authorities lives in a CA bundle file on your server. On AlmaLinux 8 and 9, the conventional path is /etc/pki/tls/certs/ca-bundle.crt, which is a symlink to the consolidated bundle generated by the system trust tools. If that file is absent, empty, or contains expired root certificates, cURL cannot complete the verification and returns error 60.

Which Fix Applies to Your Hosting Plan

The right fix depends on what level of server access you have.

Step 1: Confirm the Error

Confirm the error code is 60, not a different cURL code, before running any commands or opening a ticket. The full message in the WordPress admin screen reads:

Update Failed: Download failed. cURL error 60: SSL certificate problem: unable to get local issuer certificate

You may see this error when you try to:

• Update WordPress core from the Dashboard > Updates screen
• Install or update a plugin from Plugins > Add New
• Install or update a theme from Appearance > Themes
• Connect a plugin to a remote licensing server

If the error message includes a different cURL code, such as 6 (cannot resolve host) or 28 (timeout), the cause is different, and this guide does not apply. Once you have confirmed error 60, move to the section that matches your hosting plan.

Step 2: Fix cURL Error 60 on a VPS or Dedicated Server

If you have root SSH access to your server, you can update the CA certificate bundle yourself. The commands below apply to AlmaLinux 8 and 9, the supported operating systems for current InMotion VPS and Dedicated cPanel servers. If you need help establishing root SSH access, see How to Connect to your Server with SSH.

1. Log in to your server over SSH as the root user.
2. Update the ca-certificates package to pull the latest trusted root certificates from your distribution’s repositories.

yum update ca-certificates

3. Rebuild and activate the CA trust store so the updated certificates become available to PHP and other system tools.

update-ca-trust extract

4. Restart Apache so PHP picks up the updated CA bundle. On cPanel servers, the cPanel-recommended wrapper is preferred because it also handles cPanel’s restart logging.

/scripts/restartsrv_httpd

Note: If your server runs PHP through PHP-FPM (the default for current cPanel installations), restarting Apache alone does not reload the FPM workers. Run the cPanel restart script for PHP-FPM as well:

/scripts/restartsrv_apache_php_fpm

5. Return to the WordPress admin screen and retry the update or installation that was failing.

Note: To keep your cPanel server fully up to date after a CA bundle update, log in to WHM, navigate to Software > System Update, and run a full system update. This ensures any cPanel-managed packages that depend on the trust store are also refreshed.

Step 3: Fix cURL Error 60 on Shared or Reseller Hosting

On Shared and Reseller hosting plans, you do not have the root-level access required to update the CA bundle. The fix must be applied by InMotion Hosting’s Technical Support team. Contact Technical Support and include the following information so the technician can identify the right server and apply the update quickly:

• The domain name where the error occurs
• The exact error message: “cURL error 60: SSL certificate problem: unable to get local issuer certificate.”
• The action you were attempting (for example, installing a plugin or updating WordPress core)

InMotion Hosting Technical Support is available 24/7 by live chat and ticket. Most CA bundle updates take only a few minutes once a technician is on your server.

Troubleshooting

The error still appears after the CA bundle update

If the error persists after updating ca-certificates and restarting Apache, PHP may be pointing to a different CA file than the one you just updated. Check your active php.ini for a curl.cainfo directive and make sure it points to a valid, current bundle file.

To find your active php.ini, create a temporary file containing <?php phpinfo(); ?> and look for the “Loaded Configuration File” line. On cPanel servers, you can also view the active PHP version and edit its configuration from cPanel > MultiPHP INI Editor.

The error only happens with one specific plugin, not with WordPress core updates

Some premium plugins connect to their own licensing servers rather than to downloads.wordpress.org. If that licensing server uses a certificate issued by a newer or less common certificate authority, its root may not be present in an older CA bundle even after a standard update.

Contact the plugin developer to confirm which certificate authority signs their server’s certificate. Then check whether that root is present in your bundle at /etc/pki/tls/certs/ca-bundle.crt. You can count the entries in the bundle with this command:

grep "BEGIN CERTIFICATE" /etc/pki/tls/certs/ca-bundle.crt | wc -l

If the root is missing, contact InMotion Hosting support to have it added.

WordPress updates work, but the error still shows in the PHP error log

If WordPress updates complete successfully, but you still see cURL error 60 entries in your error logs, a background plugin process, such as a scheduled health check or telemetry call, is hitting the same issue on a different endpoint. Use the WordPress Site Health screen under Tools > Site Health to identify which test is failing, then trace the failing URL back to the plugin or core function that caused it.

Conclusion

The cURL error 60 WordPress update failure occurs because cURL cannot use a server-side CA bundle to verify remote SSL certificates. On a VPS or Dedicated server with root access, updating the ca-certificates package and running update-ca-trust extract resolves it in minutes. On Shared or Reseller hosting, InMotion Hosting support can apply the same fix at the server level. Once the bundle is current, your WordPress updates, plugin installs, and theme downloads will complete normally.

To stay ahead of update failures, see How to Enable or Disable Automatic WordPress Updates.