ERROR: cannot verify example.com's certificate

Common causes

• "Unable to locally verify the issuer's authority": the server omits its intermediate, or the CA bundle is missing.
• "Issued certificate has expired": the server certificate or an intermediate has expired.
• A corporate proxy re-signs HTTPS traffic with its own CA.
• The certificate does not match the hostname.

How to fix it

1. Install or update the CA bundle (ca-certificates package).
2. Serve the full chain on the server; check it from outside.
3. For a corporate CA, pass it with --ca-certificate=/path/ca.pem.
4. --no-check-certificate only hides the problem and is not a fix.