# "unable to get local issuer certificate" with curl **URL:** \ **Category:** Help\ **Created:** [December 27, 2020, 3:25pm UTC](https://community.letsencrypt.org/t/unable-to-get-local-issuer-certificate-with-curl/141415 "2020-12-27T15:25:36Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![ddeimeke](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ddeimeke/32/3976_2.png) [@ddeimeke](https://community.letsencrypt.org/u/ddeimeke)\ **Post date:** [December 27, 2020, 3:25pm UTC](https://community.letsencrypt.org/t/unable-to-get-local-issuer-certificate-with-curl/141415/1 "2020-12-27T15:25:36Z")
Hi! I fetched new certificates using [ACMEfetch](http://www.acmefetch.org/), which worked pretty well the last years. > **[crt.sh | lenim.myown-it.com](https://crt.sh/?q=lenim.myown-it.com)** My domain is: [lenim.myown-it.com](http://lenim.myown-it.com) Firefox is fine (the page is intentionally empty), curl gives an error: ``` $ curl -Lo - https://lenim.myown-it.com curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: https://curl.haxx.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above. ``` My web server is (include version): Apache 2.4.6 The operating system my web server runs on is (include version): CentOS 7 I can login to a root shell on my machine (yes or no, or I don't know): yes This is the relevant part of the Apache vhost config: ``` ServerName lenim.myown-it.com ErrorLog /var/log/httpd/lenim.myown-it.com/error.log CustomLog /var/log/httpd/lenim.myown-it.com/access.log combined RewriteEngine On SSLEngine On SSLProtocol all -SSLv2 -SSLv3 -TLSv1 SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA- AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128- GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA- AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256: AES256-GCM-SHA384:AES128-SHA:AES256-SHA:AES:CAMELLIA:!DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA SSLHonorCipherOrder on SSLCompression off Header add Strict-Transport-Security "max-age=31536000" SSLCertificateFile /etc/letsencrypt/lenim.myown-it.com.crt SSLCertificateKeyFile /etc/letsencrypt/lenim.myown-it.com.key ``` Any help is highly appreciated. Cheers Dirk ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [December 27, 2020, 3:34pm UTC](https://community.letsencrypt.org/t/unable-to-get-local-issuer-certificate-with-curl/141415/2 "2020-12-27T15:34:11Z")
You're not sending the intermediate certificate. While clients _can_ build a chain up to a valid root without an intermediate (with aid of cached intermediates from other sites for example), it's recommended to configure your webserver to send the correct intermediate. See the chain info from `openssl s_client -connect lenim.myown-it.com:443`: ```auto CONNECTED(00000003) depth=0 CN = lenim.myown-it.com verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 CN = lenim.myown-it.com verify error:num=21:unable to verify the first certificate verify return:1 --- Certificate chain 0 s:CN = lenim.myown-it.com i:C = US, O = Let's Encrypt, CN = R3 --- (...) ``` Please consult the documentation of ACMEfetch on how to handle intermediate certificates. ---
**Author:** ![ddeimeke](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ddeimeke/32/3976_2.png) [@ddeimeke](https://community.letsencrypt.org/u/ddeimeke)\ **Post date:** [December 27, 2020, 3:42pm UTC](https://community.letsencrypt.org/t/unable-to-get-local-issuer-certificate-with-curl/141415/3 "2020-12-27T15:42:39Z")
Thank you for the heads up. It seems strange but the following works for me: ``` SSLCertificateFile /etc/letsencrypt/lenim.myown-it.com.crt SSLCertificateKeyFile /etc/letsencrypt/lenim.myown-it.com.key SSLCertificateChainFile /etc/letsencrypt/lenim.myown-it.com.crt ``` ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [December 27, 2020, 3:46pm UTC](https://community.letsencrypt.org/t/unable-to-get-local-issuer-certificate-with-curl/141415/4 "2020-12-27T15:46:35Z")
> [@ddeimeke](#): > > It seems strange but the following works for me: You're running Apache 2.4.6 which requires `SSLCertificateChainFile` (2.4.8 and higher can load the intermediate from a file with a concatenation of the cert and intermediate with a single `SSLCertificateFile` directive). Perhaps your `lenim.myown-it.com.crt` contains the cert _and_ intermediate in one file and perhaps Apache 2.4.6 is smart enough to extract the intermediate with `SSLCertificateChainFile`? I don't know. In any case you're sending the intermediate now indeed, which was the goal 🙂 ---
**Author:** ![ddeimeke](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ddeimeke/32/3976_2.png) [@ddeimeke](https://community.letsencrypt.org/u/ddeimeke)\ **Post date:** [December 27, 2020, 3:57pm UTC](https://community.letsencrypt.org/t/unable-to-get-local-issuer-certificate-with-curl/141415/5 "2020-12-27T15:57:53Z")
I think you are right. The Apache version is too old to deliver all in one go. Nevertheless it works now. Thanks a lot for your support. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [January 26, 2021, 3:58pm UTC](https://community.letsencrypt.org/t/unable-to-get-local-issuer-certificate-with-curl/141415/6 "2021-01-26T15:58:32Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.