unable to get local issuer certificate
The client can't find the certificate's issuer
Seen in curl (error 60), OpenSSL, Python, Git, Node.js (UNABLE_TO_GET_ISSUER_CERT_LOCALLY)
The client couldn't build a chain to a CA in its trust store.
Common causes
- The server omits its intermediate certificate (browsers sometimes cope; command-line tools do not).
- The client's CA bundle is missing or out of date.
- A corporate proxy re-signs traffic with a CA the tool doesn't trust.
How to fix it
- Serve the full chain from the server (most common fix).
- Update the CA bundle (ca-certificates package, certifi for Python).
- Point the tool at your corporate CA (e.g. NODE_EXTRA_CA_CERTS, REQUESTS_CA_BUNDLE). Never disable verification.
Got a different message? Paste it into the error explainer.
Related errors
- unable to verify the first certificate · The intermediate certificate is missing
- certificate has expired · The server certificate has expired
- self signed certificate in certificate chain · The chain ends in an untrusted root
- curl: (51) SSL: no alternative certificate subject name matches target host name · The certificate doesn't match the hostname
- curl: (35) SSL connect error · The TLS handshake failed
- sslv3 alert handshake failure · The server rejected the TLS handshake
- tlsv1 alert protocol version · The peer does not accept this TLS version
- tlsv1 alert unknown ca · The peer doesn't trust the certificate's CA
- no peer certificate available · The handshake failed before a certificate arrived
- Unable to establish SSL connection. · wget could not complete the TLS handshake
- ERROR: cannot verify example.com's certificate · wget doesn't trust the server's certificate
- Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames · The certificate doesn't cover this hostname