Error: SSL certificate problem: unable to get local issuer certificate

Edson · March 13, 2019, 5:56pm

Good day, I’m setting up a speedtest server for ookla, when I do a test on the ookla page, it gives me the following error

could you help me.

mnordhoff · March 13, 2019, 6:00pm

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:

I ran this command:

It produced this output:

My web server is (include version):

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don’t know):

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):

Edson · March 13, 2019, 6:05pm

Thanks,

My domain is

speedtest.redeshibridas.com.gt

My web server
Is apache2 ubuntu 16.04

My hosting

Redes Hibridas S.A.

Version Cetbot

certbot 0.32.0

JuergenAuer · March 13, 2019, 6:19pm

Hi @Edson

I don't find a problem (checked with https://check-your-website.server-daten.de/?q=speedtest.redeshibridas.com.gt ):

Your Letsencrypt - certificate is new

CN=speedtest.redeshibridas.com.gt
	11.03.2019
	10.06.2019
expires in 89 days	speedtest.redeshibridas.com.gt - 1 entry

and your https version is ok.

Domainname	Http-Status	Sec.	G
• http://speedtest.redeshibridas.com.gt/
138.94.253.6	200	0.373	H

• https://speedtest.redeshibridas.com.gt/
138.94.253.6	200	6.970	B

• http://speedtest.redeshibridas.com.gt/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
138.94.253.6	404	0.353	A

Same with my browser - there is a standard Apache2 Ubuntu page.

Checked with SSLLabs, there is a Grade A, no incomplete chain:

https://www.ssllabs.com/ssltest/analyze.html?d=speedtest.redeshibridas.com.gt&hideResults=on

Do you have a screenshot?

Edson · March 13, 2019, 6:25pm

Thanks,

attached image of the error that I get when I test my server on ookla.com

When consulting the ookla support they indicate the following, but I do not understand, since my certificate is fine.

The certificate is not signed by a trusted authority (checking against Mozilla’s root store). If you bought the certificate from a trusted authority, you probably just need to install one or more Intermediate certificates. Contact your certificate provider for assistance doing this for your server platform.

Edson · March 13, 2019, 6:38pm

@JuergenAuer

help please

JuergenAuer · March 13, 2019, 6:53pm

I have no idea why there is an error message.

Ok, it’s port 8080, not 443.

But checking port 8080 ( https://check-your-website.server-daten.de/?q=speedtest.redeshibridas.com.gt%3A8080 ) there is the same picture: The valid Letsencrypt certificate with the correct intermediate certificate.

Ok, played with OpenSSL: Your port 443 sends the intermediate certificate:

Certificate chain
 0 s:CN = speedtest.redeshibridas.com.gt
   i:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
 1 s:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
   i:O = Digital Signature Trust Co., CN = DST Root CA X3

your port 8080 not:

Certificate chain
 0 s:CN = speedtest.redeshibridas.com.gt
   i:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3

So check your port 443 config and copy the two or three lines with the certificate files to your port 8080 - configuration.

Edson · March 13, 2019, 7:06pm

@JuergenAuer thanks for information.

I comment, when entering by https to the domain by port 8080 gives it to me safely, I do not understand what it means to place the info of 3 lines from port 443 to port 8080

I also do not know what the local failure error means

I attached the image securely

ooka

JuergenAuer · March 13, 2019, 7:30pm

Your port 443 / standard https has the correct configuration.

Your special port 8080 / not standard has the wrong configuration.

So find your vHost / port 443 and compare that with the vHost of your port 8080.

JuergenAuer · March 13, 2019, 9:58pm

That was a good idea.

Now I’ve found a solution to check the “real certificate chain” of a connection. In combination with the port specific check:

speedtest … has now (in the connections) a new row:

|0|s:CN = speedtest.redeshibridas.com.gt|

My own domain has two rows:

|0|s:CN = *.server-daten.de|
|1|s:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3|

So it’s visible that the certificate chain is incomplete. And that works with non standard ports. Must add a new warning message

Edson · March 13, 2019, 10:08pm

@JuergenAuer

I already added everything equal to the vhost 8080 and still I get the same error when running the test in digicert.

I attach errors and settings.

Captura

Edson · March 13, 2019, 10:29pm

@JuergenAuer

I do not know what else I could do to solve this error

schoen · March 14, 2019, 4:21am

Could we see the Apache configuration? Is it possible that you used cert.pem instead of fullchain.pem somewhere?

JuergenAuer · March 14, 2019, 7:29am

Then share your vHost - port 443 - configuration. These are two or three lines you have to copy:

    SSLCertificateFile /usr/local/ssl/crt/public.crt
    SSLCertificateKeyFile /usr/local/ssl/private/private.key
    SSLCertificateChainFile /usr/local/ssl/crt/intermediate.crt

Then restart your Apache and recheck your port 8080. Your incomplete chain is now visible: