<div class="post-toc-block float-default with-border"> 
						<div class="post-toc-header">Table of Contents</div>
						<nav id="md-post-toc" class="md-post-toc"></nav>
						</div><p>In this age of modern era, where privacy is one of the biggest concern SSL/TLS certificates plays a vital for secure communication over the internet. They encrypt data, ensuring it is transmitted securely between servers and clients. However, while working with SSL/TLS, you may encounter the &quot;Unable to Get Local Issuer Certificate&quot; error. So let&#8217;s try to understand why this error comes and what is SSL/TLS.</p>
<h2>What is SSL/TLS Certificate Chain ?</h2>
<p>A Certificate Authority (CA) is a trusted entity that issues SSL/TLS certificates. These certificates form a chain of trust, starting from the Root CA to Intermediate CAs, and finally to the Leaf certificate (the one installed on your server). This chain ensures that the certificate presented by a server is trusted by clients.</p>
<p><img decoding="async" src="https://wp.keploy.io/wp-content/uploads/2024/06/What-is-SSL.webp" alt="What is SSL/TLS Certificate Chain ?" /></p>
<h2>Causes of &#8216;Unable to Get Local Issuer Certificate’</h2>
<p>Usually, <code>unable to get local issuer certificate</code> error is caused by the misconfiguration of the SSL certificate on your machine. <strong>Here are some common causes of the error:</strong></p>
<ul>
<li>
<p><strong>Missing Intermediate Certificates</strong>: Intermediate certificates act as a bridge between the Root CA and the Leaf certificate. If these intermediates are missing, the client cannot verify the certificate chain, leading to the error.</p>
</li>
<li>
<p><strong>Misconfigured Server</strong>: Servers must be configured to send the entire certificate chain, excluding the Root CA. Misconfigurations, such as not including the intermediate certificates, result in clients being unable to verify the certificate.</p>
</li>
<li>
<p><strong>Outdated Certificate Store</strong>: Operating systems and browsers maintain a certificate store containing trusted Root CAs. If these stores are outdated, the client&#8217;s system may not recognize newer CAs, causing the error.</p>
</li>
</ul>
<p><img decoding="async" src="https://wp.keploy.io/wp-content/uploads/2024/06/99c9cc67-bc39-45a2-89d4-a512dd3a-1.webp" alt="Causes of &#039;Unable to Get Local Issuer Certificate’" /></p>
<h2>How to resolve this Error ?</h2>
<p>For a quick workaround, you can disable SSL globally or locally but this isn&#8217;t recommended since it creates a security issue. To resolve the error from root, you can try these steps: &#8211;</p>
<ul>
<li>
<p><strong>Updating the Certificate Store</strong>: Ensure your operating system&#8217;s certificate store is up-to-date. On Linux, you can use package managers like <code>apt</code> or <code>yum</code> to update CA certificates. On Windows, updating the operating system generally updates the certificate store.</p>
<pre><code>bash
# Update CA certificates in Ubuntu/Debian
sudo apt-get update
sudo apt-get install --reinstall ca-certificates
sudo update-ca-certificates</code></pre>
</li>
<li>
<p><strong>Configuring the Server Correctly</strong>: Add intermediate certificates to your server configuration.In Apache (2.4.8+), the <code>SSLCertificateChainFile</code> directive is deprecated. Instead, append your intermediate certificates directly into your main <code>.crt</code> file. Example:</p>
<pre><code>apache
SSLCertificateFile /etc/ssl/certs/your_domain_with_intermediate.crt
SSLCertificateKeyFile /etc/ssl/private/your_domain.key</code></pre>
</li>
<li>
<p>For Nginx, concatenate the intermediate certificates with your server certificate in the <code>ssl_certificate</code> file.</p>
<pre><code>nginx
ssl_certificate /etc/ssl/certs/your_domain.crt;
ssl_certificate_key /etc/ssl/private/your_domain.key;
ssl_trusted_certificate /etc/ssl/certs/intermediate.crt;</code></pre>
</li>
<li>
<p><strong>Handling Self-Signed Certificates</strong>: If using self-signed certificates, manually add them to the client&#8217;s trusted certificate store. On Linux, copy the certificate to <code>/usr/local/share/ca-certificates/</code> and run <code>update-ca-certificates</code>. On Windows, use the Certificate Manager (<code>certmgr.msc</code>).</p>
</li>
</ul>
<h2>How to prevent ‘unable to get local issuer certificate’ errors</h2>
<p>The main purpose of a SSL certificate is to confirm authentication so that the information passed between client and server is secure. To prevent the error, ensure that you have a valid SSL keep your certificate stores updated to avoid trust issues and regularly audit your SSL/TLS configurations, tools like SSL Labs&#8217; SSL Test can help identify issues and provide recommendations.</p>
<h3>Quick Checks to Prevent Errors:</h3>
<ul>
<li>
<p>Test your site with SSL Labs SSL Test.</p>
</li>
<li>
<p>Verify chain manually:</p>
</li>
<li>
<blockquote>
<p>openssl verify -CAfile intermediate.pem your_domain.crt</p>
</blockquote>
</li>
<li>
<p>Set up auto-renewal for certificates with <strong>Certbot</strong> or other ACME clients</p>
</li>
</ul>
<h2>Conclusion</h2>
<p>The &quot;<strong>Unable to Get Local Issuer Certificate</strong>&quot; error often stems from missing intermediate certificates, server misconfigurations, or outdated certificate stores.</p>
<h2>FAQ&#8217;s</h2>
<h3>What does the &quot;Unable to Get Local Issuer Certificate&quot; error mean?</h3>
<p>The &quot;Unable to Get Local Issuer Certificate&quot; error indicates that the client&#8217;s system cannot verify the certificate chain provided by the server. This usually occurs because the necessary intermediate certificates are missing or not correctly configured on the server. Without these intermediates, the client cannot establish a trusted connection to the server, leading to the error.</p>
<h3>How can I diagnose the &quot;Unable to Get Local Issuer Certificate&quot; error?</h3>
<p>To diagnose the error, you can use several methods:</p>
<ul>
<li>
<p><strong>Command Line Tools:</strong> Use <code>openssl s_client -connect</code> <a href="http://yourdomain.com:443"><code>yourdomain.com:443</code></a> <code>-showcerts</code> to check the certificate chain and identify any missing intermediates.</p>
</li>
<li>
<p><strong>Browser Developer Tools:</strong> In Chrome, navigate to the Security tab in Developer Tools to inspect the SSL/TLS certificate. In Firefox, click the Padlock icon in the address bar to view certificate details.</p>
</li>
<li>
<p><strong>Server Logs:</strong> Review your server logs for SSL/TLS-related errors that may indicate misconfigurations or missing certificates.</p>
</li>
</ul>
<h3>How do I update the certificate store on my system?</h3>
<p>Updating the certificate store ensures your system recognizes the latest trusted Certificate Authorities (CAs). Here’s how you can do it on different operating systems:</p>
<ul>
<li>
<p><strong>Linux:</strong> Use your package manager to update CA certificates. For example, on Debian-based systems, run <code>sudo apt-get update</code> followed by <code>sudo apt-get install ca-certificates</code>. On Red Hat-based systems, use <code>sudo yum update ca-certificates</code>.</p>
</li>
<li>
<p><strong>Windows:</strong> Updating Windows generally updates the certificate store. You can also manually update it via the Certificate Manager (<code>certmgr.msc</code>).</p>
</li>
<li>
<p><strong>macOS:</strong> Keep your macOS system updated to ensure the certificate store is up-to-date.</p>
</li>
</ul>
<h3>What steps should I take to correctly configure intermediate certificates on my server?</h3>
<p>To correctly configure intermediate certificates, follow these steps for your web server:</p>
<ul>
<li>
<p><strong>Apache:</strong> Ensure your intermediate certificates are included in the <code>SSLCertificateChainFile</code> directive. Example configuration:</p>
<pre><code>python
SSLCertificateFile /path/to/your_domain.crt
SSLCertificateKeyFile /path/to/your_domain.key
SSLCertificateChainFile /path/to/intermediate_certificate.crt</code></pre>
</li>
<li>
<p><strong>Nginx:</strong> Concatenate your server certificate and intermediate certificates into a single file and specify it in the <code>ssl_certificate</code> directive. Example configuration:</p>
<pre><code>python
ssl_certificate /path/to/your_domain_combined.crt;
ssl_certificate_key /path/to/your_domain.key;</code></pre>
<p>Ensure the combined file includes both the server certificate and the intermediate certificates in the correct order.</p>
</li>
</ul>

         
        
                    

                    
                    <div class="pp-multiple-authors-boxes-wrapper pp-multiple-authors-wrapper pp-multiple-authors-layout-boxed multiple-authors-target-the-content box-post-id-16 box-instance-id-1 ppma_boxes_16"
                    data-post_id="16"
                    data-instance_id="1"
                    data-additional_class="pp-multiple-authors-layout-boxed.multiple-authors-target-the-content"
                    data-original_class="pp-multiple-authors-boxes-wrapper pp-multiple-authors-wrapper box-post-id-16 box-instance-id-1">
                                                                                    <h2 class="widget-title box-header-title">Author</h2>
                                                                            <span class="ppma-layout-prefix"></span>
                        <div class="ppma-author-category-wrap">
                                                                                                <span class="ppma-category-group ppma-category-group-">
                                                                                                                        <ul class="pp-multiple-authors-boxes-ul">
                                                                                                                                                                                                                                                                                                                                                                                                                    <li class="pp-multiple-authors-boxes-li author_index_0 author_animesh has-avatar">
                                                                                                                                                                                                                                            <div class="pp-author-boxes-avatar">
                                                                                                                                            <img alt='Keploy Team' src='https://wp.keploy.io/wp-content/uploads/2025/06/f5085c8a-4822-4df4-9354-51edebf1-e1749103444201.webp' srcset='https://wp.keploy.io/wp-content/uploads/2025/06/f5085c8a-4822-4df4-9354-51edebf1-e1749103444201.webp' class='multiple_authors_guest_author_avatar avatar' height='80' width='80'/>                                                                                                                                    </div>
                                                            
                                                            <div class="pp-author-boxes-avatar-details">
                                                                                                                                                                                                <div class="pp-author-boxes-name multiple-authors-name">
                                                                        <a href="https://wp.keploy.io/author/animesh/" rel="author" title="Keploy Team" class="author url fn">Keploy Team</a> 
                                                                    </div>
                                                                                                                                                                                                                                                                    <p class="pp-author-boxes-description multiple-authors-description">
                                                                        Keploy is developer-centric API testing tool that creates tests along with built-in-mocks, faster than unit tests.

Keploy not only records API calls, but also records database calls and replays them during testing, making it easy to use, powerful, and extensible.                                                                    </p>
                                                                                                                                
                                                                                                                                
                                                                                                                            </div>
                                                                                                                                                                                                                                                                                                                                                                                                             </li>
                                                                                                                                                                                                                                    </ul>
                                                                            </span>
                                                                                    </div>
                    <span class="ppma-layout-suffix"></span>
                    </div>
                    
                    
                
                                <style>
                .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-author-boxes-avatar img { width: 80px !important; height: 80px !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-author-boxes-avatar img { border-style: none !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-author-boxes-avatar img { border-radius: 50% !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-author-boxes-meta a { background-color: #655997 !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-author-boxes-meta a { color: #ffffff !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-author-boxes-meta a:hover { color: #ffffff !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .ppma-author-user_email-profile-data { background-color: #655997 !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .ppma-author-user_email-profile-data { border-radius: 100% !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .ppma-author-user_email-profile-data { color: #ffffff !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .ppma-author-user_url-profile-data { background-color: #655997 !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .ppma-author-user_url-profile-data { border-radius: 100% !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .ppma-author-user_url-profile-data { color: #ffffff !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-author-boxes-recent-posts-title { border-bottom-style: dotted !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-multiple-authors-boxes-li { border-style: solid !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-multiple-authors-boxes-li { border-width: 1px !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-multiple-authors-boxes-li { border-color: #999 !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-multiple-authors-boxes-li { color: #3c434a !important; }             </style>

SSL Problem “Unable to get Local Issuer Certificate”

What Is a Test Environment? A Complete Guide for Developers

Test Recorder: The Fast-Track to Codeless UI Test Automation

A Deep Dive into V Software Development and the V-Model Approach

What Is Test Completion in Software Testing?

Sanity Checklist for Load Testing and Performance Validation

How to Use Software Testing Metrics to Drive Better QA Decisions

Load vs Performance vs Stress Testing: Differences & Examples

Building Keploy.io, an EBPF based open source framework to generate test cases and data stubs from API calls.

Neha Gupta

Cloud technology veteran and probably the youngest (globally) to have completed all 5 AWS certifications (including Solutions architect Professional and Dev­ops engineer professional)

Ssl Problem “Unable To Get Local Issuer Certificate”

More Stories