Unable to Get Local Issuer Certificate
The client cannot find the issuer of a certificate in its trust store: either the server's chain is incomplete or the client's CA bundle is out of date. Check the site below to confirm what is wrong.
- Free
- No Sign-Up
- Live Lookup
Examples:
SSL Certificate Checker
The error, and the fix
Error CodesUNABLE_TO_GET_ISSUER_CERT_LOCALLY
Usual CauseThe client cannot find the issuer of a certificate in its trust store: either the server's chain is incomplete or the client's CA bundle is out of date
Check From a Terminalopenssl s_client -connect example.com:443 -servername example.com
The client cannot find the issuer of a certificate in its trust store: either the server's chain is incomplete or the client's CA bundle is out of date.
How to fix it: Check the chain with the tool above. If it is complete, update the client's CA certificates (apt install --reinstall ca-certificates).
SSL Errors
Questions
What does "unable to get local issuer certificate" mean?
The client cannot find the issuer of a certificate in its trust store: either the server's chain is incomplete or the client's CA bundle is out of date.
How do I fix it?
Check the chain with the tool above. If it is complete, update the client's CA certificates (apt install --reinstall ca-certificates).
Is it safe to click through the warning?
Not on a site where you enter passwords or payment details: the connection may not be private. Fix the certificate instead.
Free Tools
More tools
SSL Certificate CheckerExpiry, issuer, chain, names and TLS version for any HTTPS site.DNS LookupA, AAAA, MX, NS, TXT, CNAME, SOA and CAA records for any domain.SPF CheckerValidate an SPF record and count its DNS lookups against the limit of 10.Firewall Rule GeneratorGenerate iptables, nftables and UFW rules for common server set-ups.
Stop abuse leaving your servers
Frabs watches every VM's outbound traffic and stops spam, scans and floods before the abuse report arrives.