unable to verify the first certificate
The intermediate certificate is missing
Seen in Node.js (UNABLE_TO_VERIFY_LEAF_SIGNATURE), OpenSSL
The client received the server's own certificate but not the intermediate that links it to a trusted root.
Common causes
- The server is configured with cert.pem instead of fullchain.pem.
- A load balancer or CDN was given only the leaf certificate.
How to fix it
- Install the full chain (leaf followed by intermediates) on the server.
- Re-upload the certificate bundle to the load balancer.
Got a different message? Paste it into the error explainer.
Related errors
- unable to get local issuer certificate · The client can't find the certificate's issuer
- certificate has expired · The server certificate has expired
- self signed certificate in certificate chain · The chain ends in an untrusted root
- curl: (51) SSL: no alternative certificate subject name matches target host name · The certificate doesn't match the hostname
- curl: (35) SSL connect error · The TLS handshake failed
- sslv3 alert handshake failure · The server rejected the TLS handshake
- tlsv1 alert protocol version · The peer does not accept this TLS version
- tlsv1 alert unknown ca · The peer doesn't trust the certificate's CA
- no peer certificate available · The handshake failed before a certificate arrived
- Unable to establish SSL connection. · wget could not complete the TLS handshake
- ERROR: cannot verify example.com's certificate · wget doesn't trust the server's certificate
- Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames · The certificate doesn't cover this hostname