Can't update WordPress – SSL certificate problem – error:14090086:S

Hi @dd32: many thanks for your help!

Hi @dd32

I’m seeing this issue appear with some of the sites we manage, all which are with the same host.

Is there some easy way for me to determine whether I should: a) replace the current wp-includes/certificates/ca-bundle.crt with the one provided by Marcelo above, or b) contact my host to ask whether their server uses ‘severely outdated components?

I have the same problem ??

I FIEXD it when i enabled ‘openssl’ in php.ini of my server host.

@kuleanadesign you can try the ca-bundle.crt file directly from www.ads-software.com, if that fixes it then it’ll be fixed in 4.4.1:
https://core.svn.www.ads-software.com/trunk/wp-includes/certificates/ca-bundle.crt

Dion it worked. thanks.

Replacing the current wp-includes/certificates/ca-bundle.crt with the one from core did the trick for me as well. Thanks for the help everyone.

This explains why the WordPress ca bundle doesn’t work on many servers
It isn’t fully WordPress fault, but they are partly responsible in that they are jumping the gun in removing the old certs that are still valid until 2017, replacing them with new ones and breaking the trust chain
https://myonlinesecurity.co.uk/wordpress-4-4-update-breaks-itself-with-ssl-certificate-problem-unable-to-get-local-issuer-certificate/

From what I can find out this seems to be a particular problem on CentOS 5 servers using cpanel. It is almost certainly related to the Openssl version that Cpanel use which is stuck on 0.98.x rather than the newer 1.x.x versions that come with newer server OS versions. However CentOS 5 is still supported and in very common use in hosting companies and dedicated servers.

There is a discussion about this on https://stackoverflow.com/questions/29943932/curl-php-ssl-unable-to-verify-server-side-but-not-always which explains the full technical reasons for this and why the millions of users that have older but still supported server OS. OpenSSl cannot be updated on these servers

Many users cannot update OpenSSL to a newer version without changing servers that use a different newer OS with all the associated downtime and problems that causes.

https://myonlinesecurity.co.uk/wordpress-4-4-update-breaks-itself-with-ssl-certificate-problem-unable-to-get-local-issuer-certificate/ is partially incorrect, This issue has been resolved with the 4.4.1 release. The issue impacted any sites whose SSL certs were rooted in one of the removed 1024bit certificates – www.ads-software.com was not one of those.

If anyone is still experiencing this issue with 4.4.1 we’d like to hear from you – as you’ve got a broken OpenSSL install whose behaviour doesn’t match most other servers. We’ve seen this before and the fix for those servers broke SSL for a large chunk of others.

Yes the problems appear to have gone now, but I’m not sure if it’s because we did a mass update of certs or because of the latest WP version ??

Yes the problems appear to have gone now, but I’m not sure if it’s because we did a mass update of certs or because of the latest WP version ??

The latest update would’ve overwritten any changes you made to the core files ??

The latest update would’ve overwritten any changes you made to the core files ??

Then problem solved~

The 4.4.1 update caused the problem on my server and on many others that I have heard about
The first time I ever had this problem was with 4.4. I replaced the certificate bundle and everything worked
4.4.1 update and I needed to manually replace the bundle again on all sites on the server. I have been informed of about 100 similar occurrences so 4.4.1 has not fixed the problem, at least not on Cpanel CentOS5 using OpenSSL 0.98

OpenSSL 0.98 is probably the problem, or at least it causes very similar problems.

Is there any chance you can update that? The current release is 1.0.2e.

You cannot update 0.98 on a centos 5 cpanel server.
the only way is to update centos, which means moving to a new server and that costs a lot of money and downtime and other associated problems.

I know that will need to be done when Cent OS 5 is EOL in 2017, but until then or I find some spare money for hosting. I am stuck and so are millions of other users with this problem.

Ah, that is unfortunate, who is your hosting provider?