networking tls_certificate ai_generated true

SSL: error:0A000086:SSL routines::certificate verify failed (unable to get local issuer certificate)

ID: networking/certificate-chain-incomplete

Also available as: JSON · Markdown
93%Fix Rate
92%Confidence
65Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
3 active — — —

Root Cause

The TLS server presents a leaf certificate without the required intermediate CA certificates. Clients cannot build a chain of trust to a root CA and reject the connection. This is a server-side configuration issue.

generic

Workarounds

  1. 95% success Configure the server to send the full certificate chain including intermediate CA certificates 
    1. Identify the leaf certificate issuer: openssl x509 -in cert.pem -noout -issuer
2. Download the intermediate CA certificate from the CA's repository
3. Concatenate: cat cert.pem intermediate.pem > fullchain.pem
4. Configure the server to use fullchain.pem as the certificate file
5. Verify: openssl s_client -connect host:443 -showcerts | grep 'Certificate chain'
6. Confirm the chain is complete: openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt fullchain.pem
  2. 92% success Use an ACME client like certbot that automatically provides the full chain 
    1. Install certbot: apt install certbot
2. Obtain a certificate: certbot certonly --standalone -d example.com
3. Use the fullchain.pem file (not cert.pem) in your server configuration
4. Certbot places the full chain at /etc/letsencrypt/live/example.com/fullchain.pem
5. Verify: openssl s_client -connect example.com:443 -showcerts

Dead Ends

Common approaches that don't work:

  1. Disable certificate verification on the client to bypass the error 95% fail

    Disabling verification (e.g., curl -k, verify=False) removes all TLS security guarantees and opens the connection to man-in-the-middle attacks. It does not fix the server misconfiguration.

  2. Install the leaf certificate directly into the client trust store 75% fail

    Pinning the leaf certificate works temporarily but breaks when the certificate is renewed. Every client must be manually updated, which does not scale.

Error Chain

Leads to:
Preceded by:
Frequently confused with: