SSL: certificate verify failed - unable to get local issuer certificate
ID: networking/ssl-unable-to-verify
Version Compatibility
| Version | Status | Introduced | Deprecated | Notes |
|---|---|---|---|---|
| 3 | active | — | — | — |
Root Cause
The client cannot verify the server's SSL certificate because the issuing CA certificate or intermediate certificates are missing from the local trust store. The certificate chain is incomplete or the CA bundle is outdated.
genericWorkarounds
-
88% success Update the system CA certificates bundle
1. Update the CA bundle: apt update && apt install -y ca-certificates 2. Refresh the trust store: update-ca-certificates 3. For Python: pip install --upgrade certifi 4. Set environment variable if needed: export SSL_CERT_FILE=$(python -c 'import certifi; print(certifi.where())') 5. Test: curl https://target-host.com
-
92% success Configure the server to send the full certificate chain (including intermediates)
1. Download intermediate certificates from your CA's documentation 2. Concatenate into a full chain: cat server.crt intermediate.crt > fullchain.pem 3. Configure the server to use the full chain file 4. Restart the server 5. Verify chain completeness: openssl s_client -connect host:443 -showcerts 6. Check with SSL Labs: https://www.ssllabs.com/ssltest/
Dead Ends
Common approaches that don't work:
-
Disable SSL verification in the application (e.g., verify=False in Python requests)
85% fail
Disabling verification removes all trust guarantees and exposes the application to MITM attacks. It does not fix the underlying missing CA certificate issue and creates a persistent security vulnerability that often leaks into production.
-
Manually download and install a single root CA certificate
70% fail
The issue is often a missing intermediate certificate, not the root CA. Installing only the root CA will not complete the chain if intermediates are absent. Additionally, manually managing individual CA certs is fragile and does not scale.