Is it safe to update wp-includes/certificates/ca-bundle.crt manually?

Can I overwrite WP’s ca-bundle.crt?

No.

This file and any other files in the wp-includes folder should never be updated modified or edited unless it’s to replace them with a newer version of WordPress.

If you decide to ignore that and manually update the file anyway there are several consequences:

  • on managed hosts this won’t work as WordPress core is handled separately and may not be on the same filesystem and read only. Likewise many enterprise hosts protect these folders through other means that are more structural.
  • the file would no longer match the file hash recorded for your version of WordPress, any security plugin would immediatley flag it
  • it would be overwritten on update, possibly even on every deploy
  • you would lose some WordPress specific backwards compatibility modifications: 
    ## Includes a WordPress Modification - We include the 'legacy' 1024bit. 
certificates
## for backward compatibility. See 
https://core.trac.wordpress.org/ticket/34935#comment:10

Importantly though, your system might not be using that certificate bundle at all! This is in the original changeset that introduced it:

This changeset also bundles ca-bundle.crt from the Mozilla project to allow for us to verify SSL certificates on hosts which have an incomplete, outdated, or invalid local SSL configuration.

Instead of updating it on your host, you might consider instead contributing an update to WordPress itself aiming for the next major version ( 6.7 is in beta at the time of writing ). Here’s the history https://github.com/WordPress/WordPress/commits/master/wp-includes/certificates/ca-bundle.crt

Related Posts:

  1. SSL Error: unable to get local issuer certificate
  2. When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site? [closed]
  3. When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site? [closed]
  4. When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site?
  5. Error `sec_error_revoked_certificate` when viewed in Firefox only
  6. Is there a way to force ssl on certain pages
  7. Generate WordPress salt
  8. WordPress salts set in config and database
  9. Who updates the wp-admin/core file?
  10. HSTS header not being added correctly
  11. Specific Page/Post Need to Stay Non SSL
  12. My site thinks it’s secure when it is fact not
  13. FORCE_SSL_ADMIN affecting subdomains
  14. nginx + wordpress: Best practices for configuring it to be secure, reliable, and fast? [closed]
  15. What is the difference between a cer, pvk, and pfx file?
  16. How to solve “Kernel panic – not syncing – Attempted to kill init” — without erasing any user data
  17. Error Importing SSL certificate : Not an X.509 Certificate
  18. Encrypt Password in Configuration Files?
  19. Convert .pfx to .cer
  20. Where to securely store API keys and passwords in WordPress?
  21. Why escape if the_content isnt?
  22. Full path disclosure on rss-functions.php
  23. What to use instead of wp_kses() in user output
  24. is_email() VS sanitize_email()
  25. Subscribe to email for security fixes?
  26. How to escape custom css?
  27. Understanding SVG vulnerabilities in WordPress related to a specific fix
  28. Moving wp-config.php: Can this be done after site launch?
  29. Share same domain for wp-admin but for different website
  30. Run WordPress frontend and backend in different domains
  31. Make password invalid once logged out of password-protected page
  32. How to get WordPress to save upload file beyond web root [closed]
  33. Is security a problem in WordPress?
  34. Moving wordpress out of the public directory
  35. Logout via Subdomain, non-wordpress page on a different server?
  36. How can I tell who changed the password?
  37. WordPress website Security [closed]
  38. Do I need to use the esc_html() function on hard coded links?
  39. Can’t reset WordPress password
  40. Is the “lost password” feature truly a vulnerability?
  41. Frontend Password change
  42. Is it possible to reduce the minimum character length for passwords?
  43. Handling email piping attachments and detecting unsupported file types
  44. Downloading File from Outside Web Root
  45. site get login attempts after htaccess ip restriction
  46. Is it good security advice to install wordpress in subdirectory but link to root?
  47. Why was my blog post inserted lot’s of ad links by others?
  48. Moving wp-config.php up 2 levels
  49. How Could I sanitize the receive data from this code
  50. WordPress SQL Injections through User Agent
  51. Should I Worry About SQL Injection When Using wp_insert_post?
  52. Is there a way for a user to have an alias?
  53. How to prevent wp-login brute force attack from thousand of different IP? [duplicate]
  54. Security threat with `home_url`?
  55. When is wp_set_password() called or how to capture a password
  56. How to protect wp-admin through .htaccess?
  57. Frequently getting attacks on admin-ajax.php, wp-cron.php, xmlrpc.php and wp-login.php
  58. How to get WordPress to send Password Reset Link Email instead of New Password?
  59. Verifying that I have fully removed a WordPress hack?
  60. Large Session Tokens
  61. How to change permissions of WordPress and/or apache on macOS securely?
  62. Using an Encryption class in a WordPress Plugin
  63. Limit Login Attempts BEFORE PHP is executed?
  64. Safe to say WordPress security releases don’t have database upgrades
  65. Config file with no Keys..?
  66. How much should I worry about these messages?
  67. Security concerns with external links
  68. Uploading .webm format on WordPress results in security guidline breach and fail
  69. fail2ban to prevent Brute Force Attacks on WordPress?
  70. .htaccess password protection bypassed
  71. Session Cookie security questions
  72. How to give the same error message when the wrong password or wrong username is used?
  73. Storing FTP details in wp-config.php
  74. Spam injected in w3 total cache page cache [closed]
  75. How to distinguish between a hack and an encoding error?
  76. Prevent editor from adding script or form
  77. How to change location of wp-config.php to folder or 2 folders up?
  78. How might I sanitize an XML file before WP Import? (Does wordpress verify or clean text when importing from an XML document? )
  79. Finding where a snippet of code is coming from
  80. Remove hacked code – out of ideas! [closed]
  81. Secure Server after configuration
  82. Block JSON access over the net
  83. Can someone do something to my website if I posted a snapped image of the header and covered my logo? (On reddit, when explaining a question)
  84. Security: Critical backend outside of wordpress
  85. Advice On How to Backup WordPress
  86. Front-end pages messed up due to HTTPS
  87. How to check whether a site has been compromised without browsing into it?
  88. Should I change the default file and folder permissions?
  89. WordPress exploited theme is causing high io load on server
  90. How to rewrite rules for WP-security in Nginx?
  91. How to set custom validation for WordPress Passwords?
  92. Is it a bad idea to CHMOD 777 all the files on your site?
  93. How to stop repeated hack on header.php of custom theme? [closed]
  94. WP-JSON: Cross Origin Resource Sharing Vulnerability?
  95. Heartbleed: What is it and what are options to mitigate it?
  96. Why should I firewall servers?
  97. Does drilling a hole into a hard drive suffice to make its data unrecoverable?
  98. OpenVPN vs. IPsec – Pros and cons, what to use?
  99. Fix CVE-2017-5487 vulnerability
  100. Content Security Policy blocking images from installed plugins’ popup info window, as they are from external domains – global fix?
deneme bonusu veren sitelerbahis casinomakrobetceltabetpinbahispolobetpolobet girişpinbahis girişmakrobet girişpulibet girişmobilbahis girişkolaybet giriş