unable to get local issuer certificate SSL / TLS Origin: Network Last updated 4 Nov 2026

OpenSSL: error:num=20:unable to get local issuer certificate / SSL: CERTIFICATE_VERIFY_FAILED

The client could not build a chain from the server's certificate to a CA it trusts — the issuer is missing locally or the server did not send the intermediate.

Exact message you may see unable to get local issuer certificateverify error:num=20:unable to get local issuer certificateSSL: CERTIFICATE_VERIFY_FAILED unable to get local issuer certificateVerify return code: 20 (unable to get local issuer certificate)x509: unable to get local issuer certificate
Explore the map of this error Full error map →
Seen on: SSL Linux

Meaning

Either the server sends an incomplete chain (fix with fullchain), or the client's CA bundle lacks the root (minimal containers, old systems, corporate roots). openssl s_client -showcerts shows what the server sends; update-ca-certificates or installing ca-certificates fixes the client.

Common causes

  • Server omitted intermediate certificates
  • Client missing or outdated CA bundle
  • Corporate proxy with a private root
  • Custom CA not in the trust store
  • Wrong SSL_CERT_FILE/REQUESTS_CA_BUNDLE

⚡ Quick fix

  1. Server: use the full chain file
  2. Client: apt-get install -y ca-certificates && update-ca-certificates
  3. Point tools at a bundle that includes your CA

Detailed fix by platform

Linux

  1. openssl s_client -connect host:443 -servername host -CAfile /etc/ssl/certs/ca-certificates.crt </dev/null | grep -E "Verify return|verify error"

How to diagnose

  1. Chain — What does the server send?
  2. Bundle — Client CA store updated?
  3. Proxy — Interception?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

ca md too weak / ee key too small — OpenSSL: error:0A00018E:SSL routines::ca md too weak / error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small (SSL / TLS)ca md too weak / ee k…curl: (60) SSL certificate problem — curl: (60) SSL certificate problem: unable to get local issuer certificate (SSL / TLS)curl: (60) SSL certif…DEPTH_ZERO_SELF_SIGNED_CERT — Node/OpenSSL: Error: self signed certificate (code: DEPTH_ZERO_SELF_SIGNED_CERT) (SSL / TLS)DEPTH_ZERO_SELF_SIGNE…DST Root CA X3 expired (old clients fail) — Old clients: certificate has expired — Let's Encrypt chain uses expired DST Root CA X3 (OpenSSL 1.0.x, Android < 7.1.1) (SSL / TLS)DST Root CA X3 expire…ERR_OSSL_EVP_UNSUPPORTED — Error: error:0308010C:digital envelope routines::unsupported (Node.js)ERR_OSSL_EVP_UNSUPPOR…error setting certificate verify locations — curl: (77) error setting certificate verify locations: CAfile: /etc/ssl/certs/ca-certificates.crt CApath: none (SSL / TLS)error setting certifi…HandshakeException: CERTIFICATE_VERIFY_FAILED — Dart: HandshakeException: Handshake error in client (OS Error: CERTIFICATE_VERIFY_FAILED: unable to get local issuer certificate) (Flutter / Dart)HandshakeException: C…incomplete certificate chain — SSL Labs: Chain issues: Incomplete — Extra download (intermediate certificate missing) (SSL / TLS)incomplete certificat…unable to…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.