{"id":13159905,"date":"2020-07-23T10:48:08","date_gmt":"2020-07-23T10:48:08","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/curl-error-60-due-to-expired-addtrust-certificate-with-openssl-1-0\/"},"modified":"2020-07-23T14:52:27","modified_gmt":"2020-07-23T14:52:27","slug":"curl-error-60-due-to-expired-addtrust-certificate-with-openssl-1-0","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/curl-error-60-due-to-expired-addtrust-certificate-with-openssl-1-0\/","title":{"rendered":"cURL error 60 due to expired AddTrust certificate with openSSL 1.0"},"content":{"rendered":"

My plugin uses WP_Http to make requests to another server. If this server has an SSL certificate from COMODO (now Sectigo), the WP request returns an error:<\/p>\n

cURL error 60: SSL certificate problem: certificate has expired<\/p>\n

This only happens on hosting environments with older openSSL (< 1.1.1), which I already saw on two lower-end shared hosts.<\/p>\n

I found information from Sectigo explaining the AddTrust certificate is expired as of May 30<\/a>. According to this information, it is not needed to reissue or reinstall the certificate on the server.<\/p>\n

However, in slack<\/a> I came across a discussion pointing to https:\/\/www.agwa.name\/blog\/post\/fixing_the_addtrust_root_expiration<\/a>, that explains, if I understand it correctly, that the server certificate should be fixed if it contains the expired AddTrust in the chain.<\/p>\n

Also in this slack discussion it is pointed out that it would not help if WordPress would fix its ca-bundle.crt. I don’t understand why. If I temporarily remove the “AddTrust External Root” entry there, the error is gone.<\/p>\n

I would like to understand better which side could\/should do something to fix this. Possible candidates, I think:<\/p>\n