WordPress updates or downloads fail with cURL error 60: SSL certificate problem: unable to get local issuer certificate

Symptoms

When trying to download or update plugins and themes through the WordPress admin panel, you get the following error:

CONFIG_TEXT: Update Failed: Download failed. cURL error 60: SSL certificate problem: unable to get local issuer certificate

Cause

WordPress uses an internally maintained CA certificate, which can become outdated and prevent it from connecting securely to the update servers.

Resolution

Manually clear the CA certificate and download an updated one:

1. Access your server via SSH as the root user or as the cPanel user that holds the WordPress site. 

2. Navigate to the WordPress installation's wp-includes folder and into the certificates subfolder. This will change depending on your $user and the installation path of your WordPress software. The following example would be the relative location for the primary domain's WordPress installation:

   CONFIG_TEXT: /home/$user/public_html/wp-includes/certificates

3. Move the CA bundle out to a different file:

   # mv ca-bundle.crt{,.$( date +%Y%m%d )} -v

4. In this same directory, download the latest CA bundle from WordPress:

   # wget https://raw.githubusercontent.com/WordPress/WordPress/refs/heads/master/wp-includes/certificates/ca-bundle.crt

5. If the file is downloaded while logged in as the root user, correct the downloaded file's permissions to match those of the cPanel user. The example below will work if $user is replaced with the cPanel username the website belongs to:

   # chown -v $user: ca-bundle.crt

6. Log  in to the WordPress backend and retry the plugin and theme updates.