Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I have upgraded my Multisite setup WordPress to 3.6.1. And after that, when I do Network Upgrade > Database Upgrade it's showing:

Warning! Problem updating http://www.example.com/site1. Your server may not be able to connect to sites running on it.

Error message: Peer certificate cannot be authenticated with known CA certificates

What happened please?
I'm currently using SSL for that site.

share|improve this question

4 Answers 4

up vote 1 down vote accepted

If possible, you should try and fix the cause of this error - invalid SSL certificates. But there are some instances where this is not possible or desirable. One obvious one being development sites using a self-signed SSL certs.

One way around this is to set $ssl_verify to false before line 1161 of wp-includes/class-http.php:

curl_setopt( $handle, CURLOPT_SSL_VERIFYHOST, ( $ssl_verify === true ) ? 2 : false )

The way I've done this in the past is by adding:

$ssl_verify = false;

To line 1159, before doing a multi-site upgrade and removing it afterwards. It looks like there should be much more sophisticated way of doing this. It looks from the code around it that judging by the code around it that you should be able to parse paramater sslverify=false but that doesn't appear to work (probably because the upgrade wrapper doesn't pass through the parameters).

To avoid making changes to Core I would un-do this change once you have completed the upgrade.

share|improve this answer

That error is probably due the use of cURL in the Wordpress multisite updating proccess. By default cURL will try to verify the SSL certificate with an accepted CA in a bundled set of CA certificates.

You have at least four options:

  1. Make sure you are using the last version of cURL in your PHP installation to ensure the set of used CA is updated.

  2. Manually set the path to your SSL certificate:

    curl_setopt($connection, CURLOPT_SSL_VERIFYPEER, 1); curl_setopt($AuthNetConn, CURLOPT_CAINFO, "path:/ca-bundle.crt");

  3. Bypass the SSL verification:

    curl_setopt($connection, CURLOPT_SSL_VERIFYPEER, false);

  4. Check your SSL certificate is valid and issued by an accepted CA.

For options 2 and 3 you may need to filter the arguments used by WordPress to make the http requests.
See @brasofilo's answer, it may work.

Anyway, you should investigate why the verification of the SSL is failing instead of just bypassing it.

share|improve this answer
    
I'd rather choose (3rd) option bro. But where to set that piece of code? –  シリウス Sep 23 '13 at 10:13
    
@cybnet Could you please format Code as such? –  kaiser Sep 23 '13 at 12:02

I don't know if this will help or not, but worth a try. Create a Must Use plugin and drop this lines, see code comments:

<?php
/* Plugin Name: Network upgrade exception */

// Run only in the Upgrade screen
add_action( 'load-upgrade.php', 'add_filter_wpse_115279' );

function add_filter_wpse_115279()
{
    add_filter( 'http_request_args', 'apply_filter_wpse_115279', 10, 2 );
}

// http://core.trac.wordpress.org/browser/tags/3.6.1/wp-admin/network/upgrade.php#L68 
// wp_remote_get( $upgrade_url, array( 'timeout' => 120, 'httpversion' => '1.1' ) );
// This function will end up calling WP_Http class, where we can use the filter http_request_args
function apply_filter_wpse_115279( $args, $url )
{
    # Adjust var <----------------------------------
    $ms_domain_to_check = 'http://example.com/site1/';
    if( FALSE !== strpos( $url, $ms_domain_to_check ) )
    {
        $args['sslverify'] = false;
    }
    return $args;
}

/**
 * Full list of arguments in
 * http://core.trac.wordpress.org/browser/tags/3.6.1/wp-includes/class-http.php#L84

  $defaults = array(
    'method' => 'GET',
    'timeout' => apply_filters( 'http_request_timeout', 5),
    'redirection' => apply_filters( 'http_request_redirection_count', 5),
    'httpversion' => apply_filters( 'http_request_version', '1.0'),
    'user-agent' => apply_filters( 'http_headers_useragent', 'WordPress/' . $wp_version . '; ' . get_bloginfo( 'url' ) ),
    'reject_unsafe_urls' => apply_filters( 'http_request_reject_unsafe_urls', false ),
    'blocking' => true,
    'headers' => array(),
    'cookies' => array(),
    'body' => null,
    'compress' => false,
    'decompress' => true,
    'sslverify' => true,
    'stream' => false,
    'filename' => null,
    'limit_response_size' => null,
  );

*/
share|improve this answer

I am using Wordpress 3.8.1 and I changed line 67 of wp-admin/network/upgrade.php and added , 'sslverify' => false like this:

--- a/wp-admin/network/upgrade.php      2014-03-29 14:31:28.081943490 +0100
+++ b/wp-admin/network/upgrade.php      2014-03-29 14:30:52.785947460 +0100
@@ -64,7 +64,7 @@
                        $upgrade_url = admin_url( 'upgrade.php?step=upgrade_db' );
                        restore_current_blog();
                        echo "<li>$siteurl</li>";
-                       $response = wp_remote_get( $upgrade_url, array( 'timeout' => 120, 'httpversion' => '1.1' ) );
+                       $response = wp_remote_get( $upgrade_url, array( 'timeout' => 120, 'httpversion' => '1.1', 'sslverify' => false ) );
                        if ( is_wp_error( $response ) )
                                wp_die( sprintf( __( 'Warning! Problem updating %1$s. Your server may not be able to connect to sites running on it. Error message: <em>%2$s</em>' ), $siteurl, $response->get_error_message() ) );
                        do_action( 'after_mu_upgrade', $response );

This way the verification is only disabled in this specific case and with a patch file you can easily apply the changes after an upgrade:

# go to the directory with wp-admin/ in it
cd wordpresshomedir

# without --dry-run if there are no errors
patch --dry-run -p1 < ../disable-sslverify.patch
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.