An update fails, a plugin cannot reach its licence server, or Site Health reports "cURL error 60: SSL certificate problem: unable to get local issuer certificate". Your server tried to talk to another site over HTTPS and could not confirm that site's certificate was real, so it refused to connect. Visitors are not affected. Usually the server's list of trusted certificates is out of date, the site being called is missing part of its certificate, or the server's clock is wrong. Here is how to tell which.
What the owner sees
harborbakery.example/wp-admin/site-health.php
What the checks found
Which problem is it? (five minutes)
Read which address the error names. Site Health and most plugins print the address they were calling. If it is api.wordpress.org or downloads.wordpress.org, the fault is on your server. If it is one plugin's licence or API server, try step 3 on that address first. If it is your own site's address, it is a loopback call and step 3 on your own site is the test.
Check the WordPress version. WordPress carries its own list of trusted certificates and updates it with each release. A site several major versions behind can fail every call to WordPress.org. Dashboard, Updates shows the version; if updating from there fails too, the install and update failed guide covers the manual route.
Test the named site's certificate. Put the address into a free SSL checker such as SSL Labs. "Chain issues: Incomplete" or "extra download" means that site is not sending its intermediate certificate. Browsers often hide this; servers do not.
Check the server's clock. Settings, General shows "Universal time". If it is hours or days off the real time, certificates look not yet valid or expired. Error text that says "certificate has expired" for a site that works in your browser points here.
Ask whether anything sits in the middle. Some hosts and office networks run a filtering proxy that replaces certificates. "Self-signed certificate in certificate chain" in the error is the sign.
Fix it, safest first
Update WordPress, then the plugin that fails. A current WordPress brings a current certificate list for its own calls, and a current plugin often brings fixes for its own. Back up first.
Ask the host to update the server's certificate store. Plugins that call cURL directly use the server's list, not WordPress's. Ask support: "outgoing HTTPS from PHP fails with cURL error 60; please update the CA certificates and check curl.cainfo / openssl.cafile in php.ini". An old PHP or OpenSSL version needs the same request; the outdated PHP guide covers the upgrade.
If your own site is the one named, install the full certificate chain, not only the site certificate. In cPanel, SSL/TLS, Manage SSL sites, paste the CA bundle into its box, or re-issue the free certificate from the host's panel, which installs the chain for you. Then run the SSL checker again.
If another company's site is named and its chain is incomplete, tell that company's support; only they can fix it. Send them the SSL checker result.
Fix the clock: ask the host to sync the server time (NTP). Changing the time zone in Settings, General does not change the server clock.
Behind a filtering proxy, ask the host or network admin to exempt the server's outgoing traffic, or to give you their certificate to add to the server's trusted list.
What you see, what it means, what it needs
What you see
What it means
Usual fix
"unable to get local issuer certificate" on api.wordpress.org
Old certificate list (old WordPress or old server)
Update WordPress; host updates CA certificates
Only one plugin's licence check fails
That vendor's server misses its intermediate certificate, or the plugin uses the server's old list
SSL checker on the vendor address; tell the vendor or the host
Error names your own site (loopback)
Your certificate chain is incomplete
Install the CA bundle or re-issue the certificate in the host panel
"certificate has expired" for a site that works in a browser
Server clock is wrong
Host syncs the server time
"self-signed certificate in certificate chain"
A proxy replaces certificates
Exempt the server, or trust the proxy's certificate
What not to do
Do not install a plugin or snippet that sets sslverify to false. It hides the error by switching off the check, so anyone in the middle can feed your site fake updates.
Do not download a certificate bundle from a random site and point PHP at it. Get it from the host or the operating system's own updates.
Do not buy a new certificate for your own site before running the SSL checker; most often the one you have is fine and only the chain is missing.