Unable to Get Local Issuer Certificate: Fix for curl, Git, npm, Python and PHP

What the error looks like

Every tool that uses OpenSSL, or a CA list of its own, reports the same failure in its own words:

Tool	Typical message
curl	curl: (60) SSL certificate problem: unable to get local issuer certificate
Git	fatal: unable to access 'https://...': SSL certificate problem: unable to get local issuer certificate
npm and Node.js	UNABLE_TO_GET_ISSUER_CERT_LOCALLY (unable to get local issuer certificate)
Python requests and pip	[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate
PHP cURL	SSL certificate problem: unable to get local issuer certificate (cURL error 60)
openssl s_client	Verify return code: 20 (unable to get local issuer certificate)

A certificate chain normally has three links: your domain's certificate, the CA's intermediate certificate and the CA's root certificate. The client already holds the root in its CA store; the server must send the other two. If either link is missing on its side, the client stops with this error. Browsers show the same problem as NET::ERR_CERT_AUTHORITY_INVALID (Chrome, Edge) or SEC_ERROR_UNKNOWN_ISSUER (Firefox).

Find out which side is at fault

Test the server with our free SSL Checker, or look at the chain yourself:

openssl s_client -connect example.com:443 -servername example.com -showcerts

The -showcerts option lists the certificates exactly as the server sends them, under "Certificate chain". Then compare:

• Only certificate 0 (your domain) is listed. The server does not send its intermediate certificate. Fix the server (step 3); this fixes the error for every client.
• The chain is complete, but the error appears on one machine or network only. The client is at fault. If the issuer (i:) of certificate 0 names your company, a firewall or an antivirus product instead of a public CA, a proxy re-signs the traffic. Go to steps 4 and 5.

If openssl s_client reports code 20 for every website, your own OpenSSL has no CA store configured (common on Windows). Add -CAfile /path/to/ca-bundle.pem to the command and test again.

Fix on the server: install the full chain

Browsers often hide a missing intermediate because they cache intermediate certificates or download them on their own, so the site looks fine in Chrome while curl, Git, Python and mobile apps fail.

1. Get the right intermediate certificate. Your CA sends it with the certificate (often as a CA bundle file). You can also download it from our intermediate and root certificates pages: GoGetSSL, Sectigo, DigiCert, GeoTrust, RapidSSL and Thawte.
2. Nginx: put your certificate first and the bundle after it in one file, then point ssl_certificate to that file:

   cat example.com.crt ca-bundle.crt > example.com.chained.crt

3. Apache 2.4.8 and later: add the intermediate certificates to the file in SSLCertificateFile, after your certificate (leaf to root). On older versions use SSLCertificateChainFile.
4. Other servers and panels (IIS, cPanel, Plesk, load balancers) have a separate "CA bundle" or "intermediate" field. Paste the bundle there.
5. Restart the web server and run the SSL Checker or the openssl command again. You should now see certificates 0 and 1.

Automated tools renew certificates without forgetting the chain: Automated SSL issues, installs and renews them with the correct intermediate certificate.

Fix on the client: update the CA store

If the server chain is complete, the client's list of trusted roots is the problem. First update it. On Debian and Ubuntu:

sudo apt install --reinstall ca-certificates

Behind a corporate proxy or antivirus that inspects HTTPS, ask your IT team for their root certificate in PEM format and add it to the system store. Only add CA certificates you were given by your own organization.

Debian and Ubuntu (the file must end in .crt):

sudo cp corporate-root.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

RHEL, Rocky Linux, Fedora:

sudo cp corporate-root.pem /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

On Debian and Ubuntu the result is the bundle /etc/ssl/certs/ca-certificates.crt, which you can give to the tools below. On Windows and macOS, IT usually installs the root in the system store; the tools below can be told to use that store or a PEM file.

Per-tool fixes

Many developer tools ship their own CA list and ignore the system store. In the commands below, replace /path/to/ca-bundle.pem with a full bundle (for example the system bundle from step 4) and corporate-root.pem with your organization's root certificate. The export lines are for Linux and macOS; on Windows, set a variable permanently with setx NAME "C:\path\to\file.pem" and open a new terminal.

curl

Pass a bundle for one request, or set it for the whole session:

curl --cacert /path/to/ca-bundle.pem https://example.com
export CURL_CA_BUNDLE=/path/to/ca-bundle.pem

Newer curl versions also accept --ca-native to use the operating system's CA store. On Windows, many curl builds also look for a file named curl-ca-bundle.crt next to curl.exe.

Git

git config --global http.sslCAInfo /path/to/ca-bundle.pem

On Windows, the simplest fix is to let Git use the Windows certificate store, which already contains roots that IT deployed:

git config --global http.sslBackend schannel

With schannel, Git ignores http.sslCAInfo unless you also set http.schannelUseSSLCAInfo to true. The GIT_SSL_CAINFO environment variable overrides http.sslCAInfo.

npm and Node.js

npm config set cafile=/path/to/ca-bundle.pem

npm then trusts only the certificates in that file, so it must be a full bundle, not just one certificate. For Node.js scripts, and for npm too, it is often easier to add one root to Node's built-in list:

export NODE_EXTRA_CA_CERTS=/path/to/corporate-root.pem

Node reads NODE_EXTRA_CA_CERTS only when the process starts, so set it before you run node or npm. Node.js 23.8 and later can also use the system store with --use-system-ca (or NODE_USE_SYSTEM_CA=1 from Node.js 22.19 and 24.6).

Python requests and pip

requests uses the CA bundle of the certifi package. Update it first, and print its location if you need it:

python -m pip install --upgrade certifi
python -m certifi

Do not add your own certificates to certifi's file: upgrades overwrite it. Point requests to your bundle instead, either in code with verify='/path/to/ca-bundle.pem' or for every script:

export REQUESTS_CA_BUNDLE=/path/to/ca-bundle.pem

For pip, pass the bundle with --cert (or set PIP_CERT). pip 24.2 and later also use the system certificates in addition to certifi, so upgrading pip often fixes the error.

pip install --cert /path/to/ca-bundle.pem package-name

On macOS with Python from python.org, run Install Certificates.command in the Applications/Python 3.x folder once after installing.

PHP

PHP's cURL functions use curl.cainfo, and its stream functions (file_get_contents, fsockopen) use openssl.cafile. Set both in php.ini to an absolute path:

curl.cainfo = "/path/to/cacert.pem"
openssl.cafile = "/path/to/cacert.pem"

Restart PHP-FPM or the web server afterwards. On Windows, PHP often has no CA file set at all: download Mozilla's CA bundle from curl's CA extract page and add your corporate root to it if needed.