# OpenSSL: error:num=20:unable to get local issuer certificate / SSL: CERTIFICATE_VERIFY_FAILED

**Code:** `unable to get local issuer certificate` · **Category:** SSL / TLS · **Seen on:** SSL, Linux

The client could not build a chain from the server's certificate to a CA it trusts — the issuer is missing locally or the server did not send the intermediate.

## Meaning

Either the server sends an incomplete chain (fix with fullchain), or the client's CA bundle lacks the root (minimal containers, old systems, corporate roots). `openssl s_client -showcerts` shows what the server sends; `update-ca-certificates` or installing `ca-certificates` fixes the client.

## Common causes

- Server omitted intermediate certificates
- Client missing or outdated CA bundle
- Corporate proxy with a private root
- Custom CA not in the trust store
- Wrong `SSL_CERT_FILE`/`REQUESTS_CA_BUNDLE`

## Quick fix

1. Server: use the full chain file
2. Client: `apt-get install -y ca-certificates && update-ca-certificates`
3. Point tools at a bundle that includes your CA

## Detailed fix by platform

### Linux

1. `openssl s_client -connect host:443 -servername host -CAfile /etc/ssl/certs/ca-certificates.crt </dev/null | grep -E "Verify return|verify error"`

## How to diagnose

1. **Chain** — What does the server send?
2. **Bundle** — Client CA store updated?
3. **Proxy** — Interception?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/ssl/certificate-verify-failed-unable-to-get-local-issuer)