Unable to get local issuer certificate and unable to verify the first certificate

[lwin]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: temploggerlwin.site

I ran this command: openssl s_client -connect temploggerlwin.site:443 -servername temploggerlwin.site

It produced this output:
CONNECTED(00000003)
depth=0 CN = temploggerlwin.site
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = temploggerlwin.site
verify error:num=21:unable to verify the first certificate
verify return:1

My web server is (include version): I am using nginx

        listen 443 ssl http2 default_server; # managed by Certbot
        listen [::]:443 ssl ipv6only=on; # managed by Certbot
        ssl_certificate /etc/letsencrypt/live/temploggerlwin.site/fullchain.pem; # managed by Certbot
        ssl_certificate_key /etc/letsencrypt/live/temploggerlwin.site/privkey.pem; # managed by Certbot
        include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

The operating system my web server runs on is (include version):
Distributor ID: Ubuntu
Description: Ubuntu 24.10
Release: 24.10
Codename: oracular

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 4.0.0

[orangepizza]

I have no problem connecting it from ubuntu 24.04: (although wsl)
cloud you reinstall ca-certificates package from client?

[lwin]

Hi @orangepizza , After reinstall , still having the issue.

[lwin]

If I call from the browser, it shows like this.

[orangepizza]

can we see what certificate client gets when it connect to server?

[webprofusion]

Check that www.temploggerlwin.site resolves to the server you think it does. It's working fine externally but may be failing or you on your own network (e.g. it could be resolving to a different host)

[lwin]

@orangepizza , Yes, Please.
CONNECTED(00000003).txt (6.8 KB)

[orangepizza]

i:C = US, ST = California, L = Sunnyvale, O = Fortinet, OU = Certificate Authority, CN = FGT61ETK18026947, emailAddress = support@fortinet.com
-----BEGIN CERTIFICATE-----

you have a fortinet intercepting TLS connection

[lwin]

@webprofusion , Oh ya, It's working fine with another network. So my network is blocking because of invalid cert?

[webprofusion]

Yes, speak to your company networking team.

[lwin]

@webprofusion @orangepizza Thank you so much for the help. Since you point out fortigate, I found this thread => Certificate not trusted by Fortigate and I also found this to validate by fortigate whether my site is valid or not.