SSL error: unable to get local issuer certificate

Likely causes

1. The server sends only its own certificate, not the intermediate that signed it. Browsers often hide this; curl and apps do not.
2. The client's trust store is missing the root (a private CA never installed, or a store emptied).

Diagnose

Run these in order. The output is what each printed on a lab's real Linux machines.

laptop:~# curl -sS https://blog.lab/

curl has blog's certificate but nothing that leads from its issuer to a root.

curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html
…

laptop:~# curl -sv https://shop.lab/

A good server for comparison: curl -sv shows the issuer and Certificate level 0 to 2, the whole chain, then SSL certificate verify ok.

…
* Server certificate:
*  subject: CN=shop.lab
*  start date: Oct 12 15:56:15 2026 GMT
*  expire date: Apr 29 15:56:15 2027 GMT
*  subjectAltName: host "shop.lab" matched cert's "shop.lab"
*  issuer: CN=netlab lab issuing CA
*  SSL certificate verify ok.
*   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 2: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
…

Fix

update-ca-certificates

On the client, when its store is missing the CA: put the CA certificate in /usr/local/share/ca-certificates/ and rebuild the store.

The fix the lab's challenge "Nothing internal is trusted" checks.

Break it and fix it yourself

Each lab is a small network of real Linux machines in your browser, where this fault happens.

• TLS certificates: chains, trust and what breaks them Pro: its challenges "Works in my browser" and "Nothing internal is trusted" set the fault for you to find and fix.

Open TLS certificates: chains, trust and what breaks them