cURL error 60 in PHP means the underlying cURL library couldn't verify the server's certificate chain — commonly because PHP's cURL isn't configured with a path to a current CA bundle file, particularly common on Windows PHP installations where a CA bundle isn't included by default the way it typically is on Linux.
The fix
curl.cainfo = "C:\path\to\cacert.pem"Download a current CA bundle (curl's official project maintains one, extracted from Mozilla's trusted root list) and point curl.cainfo in php.ini to it. Avoid disabling SSL verification (CURLOPT_SSL_VERIFYPEER set to false) as a workaround — this removes the actual security benefit of the check rather than fixing the underlying missing-CA-bundle issue.
What curl error 60 specifically indicates in a PHP context
This error corresponds directly to curl's CURLE_SSL_CACERT code, meaning PHP's cURL extension couldn't verify the server's certificate against its available trust store — the same underlying issue covered in our dedicated curl error decoding guide, just surfaced through PHP's specific wrapper around the curl library.
How to fix this without disabling certificate verification entirely
Updating PHP's bundled CA certificate file (cacert.pem, available from the curl project) to a current version resolves most instances of this error where the underlying cause is simply an outdated trust bundle, without resorting to disabling verification, which should never be treated as an acceptable production fix.
What PHP configuration file setting controls the default CA bundle location
PHP's php.ini file includes a curl.cainfo setting that can point to a specific, updated CA bundle file location — confirming this setting points to a valid, current bundle file (rather than a missing or outdated one) resolves this error when an outdated or misconfigured bundle path is the underlying cause.
How to test whether this is a PHP-specific issue or affects the server more broadly
Testing the same URL directly with command-line curl, independent of PHP entirely, isolates whether the issue is specific to PHP's cURL extension and its bundled trust configuration, or reflects a broader, server-wide certificate problem affecting every client regardless of language.
A final note on preventing recurrence in production
For a production PHP application specifically, automating CA bundle updates as part of your regular server maintenance and deployment process, rather than only updating reactively when this error first appears, prevents the underlying cause from recurring as bundled trust data gradually ages.
What the exact PHP code looks like for properly specifying a custom CA bundle
Setting the CURLOPT_CAINFO option to a specific, current CA bundle file path in your PHP cURL configuration lets you explicitly control which trust source is used, rather than relying entirely on PHP's own default, which may be outdated depending on your specific PHP installation and configuration.
How shared hosting environments specifically complicate fixing this error
On shared hosting where you don't control the underlying PHP installation or its bundled CA file, you may be limited to application-level workarounds (like manually specifying a current CA bundle within your own code) rather than being able to update the server's own PHP configuration directly.
A quick closing checklist
A quick closing checklist covers checking PHP's configured CA bundle path, updating to a current bundle if outdated, and testing with command-line curl independently to confirm whether the issue is PHP-specific or reflects a broader server-side certificate problem.
Why some managed hosting platforms handle this differently than a self-managed server
Managed PHP hosting platforms often handle CA bundle updates automatically as part of their platform maintenance, meaning this error is considerably less common there than on a self-managed server where you're responsible for keeping the underlying system and PHP installation's trust data current yourself.