TLS: unable to get local issuer certificate

Quick fix

Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.

# See exactly what the server sends
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null

# If only the leaf is shown, the server is missing its intermediate.
# nginx: concatenate leaf + intermediate into one file
cat leaf.crt intermediate.crt > fullchain.crt
# ssl_certificate /etc/nginx/fullchain.crt;

# If the chain is complete, the client trust store is the problem
apt-get install -y ca-certificates && update-ca-certificates

How to diagnose TLS errors

TLS errors have a small number of root causes: the certificate is expired, the hostname does not match any SAN entry, the chain is incomplete (the server did not send its intermediates), the issuing CA is not trusted by this client, or the two sides share no cipher or protocol version. The incomplete-chain case is the most deceptive, because browsers often paper over it with cached intermediates while curl, Java and Go fail.

If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.

1. Inspect the live handshake: openssl s_client -connect host:443 -servername host -showcerts. It shows the full chain the server actually sends.
2. Check dates and SANs: openssl x509 -noout -dates -subject -ext subjectAltName. The Common Name is ignored by modern clients: only SANs matter.
3. If browsers work but curl or your language runtime does not, suspect a missing intermediate. Browsers cache intermediates; other clients do not.
4. Verify the trust store the failing client uses. Containers frequently ship without ca-certificates installed, and Java, Node and Python each have their own store.
5. For protocol or cipher errors, check the negotiated version and the server's supported list. TLS 1.0 and 1.1 are disabled by default in current clients.

Tools worth reaching for

• openssl s_client
• openssl x509 -noout -text
• curl -vI
• testssl.sh
• sslyze

Authoritative references

Primary documentation for this error, worth reading before applying any fix in production.

📖 curl.se

Related TLS errors

• Apache mod_ssl errorApache's SSL module encountered an error, often due to misconfigured SSL directives.
• Certificate chain incompleteSSL certificate chain is missing intermediate certificates, causing trust validation to fail.
• Certificate has expiredThe SSL certificate is past its expiration date and is no longer valid for secure connections.
• Client certificate requiredServer requires client certificate authentication but none was provided.
• curl: (56) OpenSSL SSL_read: Connection reset by peerThe SSL connection was abruptly closed by the remote server, often due to protocol mismatch…
• ERR_SSL_PROTOCOL_ERRORBrowser detected an SSL protocol violation or misconfiguration. Often caused by mixed…
• Hostname verification failedThe SSL certificate's hostname doesn't match the requested domain name.
• Invalid SSL certificateThe SSL certificate is malformed, self-signed, or doesn't meet security requirements.

See all 24 TLS errors →

Browse other categories

• HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
• JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
• Database 41Connections, deadlocks, constraints, replication and memory limits.
• AI 35Rate limits, context windows, GPU memory and model-serving failures.
• Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
• Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
• Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
• Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
• System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
• Cloud 25IAM permissions, quotas, service limits and credential failures.
• Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
• Frontend 23Hydration mismatches, bundler resolution, layout shift and font loading.

Something missing or wrong?

This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.