I can't upgrade plugins and themes

This error is caused by your server having an outdated version of curl and/or the OpenSSL library.

Modern SSL certificates are signed using the SHA-256 algorithm, which your older code lacks support for. You need to update your server, or if you have a webhost, they need to update it for you.

Note that all older versions of OpenSSL are considered to be dangerously insecure, and you should be updating these in any case. If the webhost cannot update the server, then it’s time to find a new hosting service.

Thank you for your assistance, Samuel!

I have sent a message to my Web Hosting provider and await a response.

I am having same problem on two completely separate blogs, both hosted by Yahoo. The blogs have been running for over a year, with no problems. They both started this failure to update plugins within the last couple of weeks. I also get the error Download failed. error:0D0890A1:asn1 encoding routines:ASN1_verify:unknown message digest algorithm
Yahoo claims they haven’t changed anything. The problems does seem to coincide with the update of WordPress to ver. 4.3. I tried disabling all my plugins and then updating them individually and as a group, both while disabled and after enabling them one at a time. No difference. Same error. Tried to reinstall WordPress, and got the same error.
I have not tried to install anything manually, because I am not sufficiently sophisticated to be able to do that. Besides, even if I could learn how, I don’t want to be manually installing updates for all my plugins, that is the reason I use the darn dashboard. I also have no idea how to code.

Alan

The problems does seem to coincide with the update of WordPress to ver. 4.3.

The problem would have started with any version of WordPress later than 3.7. If you were running 3.6 before and updated to 4.3, then you would experience this issue if your server was also badly out-of-date.

WordPress 3.7 introduced auto-updating, and with that, it also introduced updating exclusively over HTTPS connections. If it cannot verify the security of the download, then it will not download the update.

Again, same issue, same problem. Update to a more recently updated server.

No, that’s not it. I have been updating to every version of WordPress as soon as it came out for the last two years and no problem with plugin updates. So either something changed in WordPress 4.3 or Yahoo changed something with their SSL. Yahoo says not, so that leaves WordPress 4.3 as the culprit. I note from the forums that I am not the only one experiencing this updating problem, and it is not confined to plugins, but seems to include themes as well.

And by the way, who decides to mark this “resolved”, since it certainly is not?

I believe the issue has to do with Yahoo SSL not compatible with Windows 10 (as soon as I upgraded to Windows 10 I started receiving error messages and unable to upgrade plugins/themes).

I found a temporary fix – a plugin called, ‘skip SSL verify’ php, which after manually installing, helped me upgrade the plugins for now.

Didn’t upgrade to Windows 10 and having the same problem whether I log in on a Win 7 or a Win 8 machine. A little worried about the skip SSL, as I see that the advice (from Otto, I think) is not to do this as it creates a security problem.

I still think it has something to do with Yahoo because I’m not experiencing the same issue with 2 other blog sites hosted by other web hosting providers. No error messages.

It is absolutely a problem with Yahoo hosting. Many other threads exist in these forums with the same error, and not all of them on 4.3.

https://www.ads-software.com/support/topic/theme-installation-through-yahoo

https://www.ads-software.com/support/topic/download-error-cannot-add-themes-to-clean-wordpress-installation

https://www.ads-software.com/support/topic/error-installing-wordpress-theme

We even have threads where security plugins won’t work properly because Yahoo has old SSL libraries:

https://www.ads-software.com/support/topic/wordfence-could-not-get-an-api-key-2

The best advice I can give you: Don’t use Yahoo web hosting. Switch to a better hosting provider. I don’t have the first clue why you would only suddenly start experiencing the problem now, but we have threads going back to 3.7, when using encrypted SSL connections for updates became the standard.

I agree with you, Samuel.

If Yahoo doesn’t resolve this for me today, I will switch to another hosting provider. It has been 2 weeks now and I feel I’m getting the run around from them. Very disappointed to say the least.

Thank you all for your comments and advice.

I am no fan of Yahoo, but it seems like the rest of the WordPress forum is blowing up with this problem, not all are Yahoo and the consensus seems to be that it is related to 4.3
Read toward the bottom of this post
https://www.ads-software.com/support/topic/read-this-first-%E2%80%93-wordpress-43-master-list?replies=4
https://www.ads-software.com/support/topic/updates-fail-since-the-43-upgrade

Indeed, Otto (or is it Sam?), even you have identified 4.3 as the culprit for plugin update problems
https://www.ads-software.com/support/topic/after-43-update-im-unable-to-update-plugins-or-themes?replies=48

You wrote:

@dm652: This is the fix that is currently in the trunk code.
https://core.trac.www.ads-software.com/changeset/33688

A fix for 4.3.1 is still being worked on.

If you are having this problem right now and need a remedy, then patching your copy of WordPress now is fine. Any future updates to fix the issue will simply overwrite this file, so your custom patch won’t cause any harm.

But unfortunately, I don’t code and have no idea how to make that fix

@alan.yatvin: There are problems we understand, and problems we don’t. In this case, for this specific problem, we fully understand it, the issues with it, and the various assorted consequences of it.

This is not a 4.3 problem. You can take that answer to the bank. The link you posted about SSH has nothing whatsoever to do with your issue. It’s completely unrelated. I realize that technical terms like “SSH” and “SSL” are involved, but those are not the same thing, in the slightest.

This is not a 4.3 specific problem. This is a problem with your host. I’m not shooting in the dark here. I do know what I’m talking about. Really.

If you doubt me and want to talk one-on-one, to better understand how I’m trying to lead you to a solution, then by all means, email me. My email address is otto at wordpress dot org.

Just to be sure I’m tracking here (and I do have the same problem on a client site)…

1. WP sites running on Yahoo! hosting wont run ANY updates (system, themes, or plugins) because of this “outdated SSLs” issue (something about failing to support security protocols)
2. Yahoo! hasn’t made the required security updates (for whatever reason)
3. Nobody wants to do manual updates for everything (and some people have no idea how to do those)
4. Some of us are dealing with client sites that we do not control (and cannot just move to another hosting solution)

Is there ANY workaround WITHIN WP that allows us to “accept the risk” (so to speak) and enable the auto-updates on Yahoo! hosted websites?

(An interesting point: On the one Yahoo! hosted client site I work with, I was able to INSTALL themes and plug-ins, but cannot UPDATE anything – which seems very strange given the conversations / links above…)

Hi Klynam

Yes, there’s a temporary fix that I used to update already installed plugins in WP. It is as follows:

<?php
/*
Plugin Name: Skip SSL Verify
Plugin URI: https://www.damiencarbery.com
Description: Skip SSL verify in curl downloads – fixes: Download failed. error:0D0890A1:asn1 encoding routines:func(137):reason(161).
Author: Damien Carbery
Version: 0.1

$Id: $
*/

function ssv_skip_ssl_verify($ssl_verify) {
return false;
}
add_filter(‘https_ssl_verify’, ‘ssv_skip_ssl_verify’);
add_filter(‘https_local_ssl_verify’, ‘ssv_skip_ssl_verify’);

In the meantime, Yahoo apparently escalated my issue.