Unable to Get Local Issuer Certificate (curl 60, Git, Node.js): How to Fix

This is OpenSSL verification error 20, X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY. The OpenSSL manual describes it as «The issuer certificate could not be found: this occurs if the issuer certificate of an untrusted certificate cannot be found» (X509_STORE_CTX_get_error). «Local» is the key word: the verifier walked up the chain the server sent and, at the top, looked for the next issuer in the client's own trust store and did not find it.

The same error reaches you in different clothes:

• curl: curl: (60) SSL certificate problem: unable to get local issuer certificate (exit 60, CURLE_PEER_FAILED_VERIFICATION).
• Git: fatal: unable to access 'https://example.com/repo.git/': SSL certificate problem: unable to get local issuer certificate.
• Node.js, npm and tools built on them: Error: unable to get local issuer certificate with code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY' (Node.js X509 error codes).
• Python: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate, covered on the Python page.

It is a trust problem, not a broken connection: the TLS handshake started fine and the client refused to continue.

Which certificate is the «untrusted» top of the chain decides the case. OpenSSL raises error 20 when the topmost certificate it has is not self-signed and its issuer is not trusted locally (x509_vfy.c). If the top is the leaf itself, the intermediate is missing. If the top is an intermediate from a public CA, the client lacks the root. If the top is issued by «Zscaler», «Fortinet» or your antivirus, the traffic is being inspected.

Browsers hide the first case: Chrome and Safari download a missing intermediate from the URL inside the certificate and Firefox ships known intermediates preloaded, while curl, Git, Node.js and most libraries do neither. That is why «it works in my browser» is the classic symptom of a missing intermediate.

openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null | grep -E '^ *[0-9] s:|^ *i:'
 0 s:CN = example.com
   i:C = US, O = Let's Encrypt, CN = R11

One certificate (only depth 0) whose issuer is an intermediate means the server omits the chain. A healthy answer lists the leaf at depth 0 and its intermediate at depth 1. In the full output, verify error:num=20:unable to get local issuer certificate followed by Verify return code: 21 (unable to verify the first certificate) is the same missing-intermediate case, reported twice because s_client keeps verifying after the first error.

If the chain looks complete but your client still fails, test it against a known bundle to separate «server» from «client»:

curl -v --cacert /etc/ssl/certs/ca-certificates.crt https://example.com/
openssl s_client -connect example.com:443 -servername example.com -CAfile /etc/ssl/certs/ca-certificates.crt </dev/null

1. Server owner: serve the full chain. In nginx, ssl_certificate must point to the leaf followed by its intermediates (with Certbot, fullchain.pem, not cert.pem). In Apache 2.4.8+, put the intermediates in the same file as the certificate. Reload and re-run the -showcerts check.
2. Debian, Ubuntu, Alpine containers: install the bundle: apt-get install -y ca-certificates or apk add ca-certificates. Slim images often ship without it.
3. Private or corporate CA on Linux: copy the root to /usr/local/share/ca-certificates/corp-root.crt and run update-ca-certificates (Debian family); on RHEL family use /etc/pki/ca-trust/source/anchors/ and update-ca-trust.
4. Git: point it at the bundle with git config --global http.sslCAInfo /path/to/ca-bundle.pem (or GIT_SSL_CAINFO). On Windows, git config --global http.sslBackend schannel makes Git use the Windows certificate store, where corporate roots usually already are (git-config).
5. Node.js and npm: Node trusts its own bundled CA list, not the OS store. Add a root with NODE_EXTRA_CA_CERTS=/path/corp-root.pem (read once at start) or, on Node 23.8 and later, run with --use-system-ca. For npm alone: npm config set cafile /path/corp-root.pem.
6. Do not disable verification with -k, git -c http.sslVerify=false or NODE_TLS_REJECT_UNAUTHORIZED=0. Node's own documentation calls the last one strongly discouraged: it turns off certificate validation for every connection the process makes.

curl -sS -o /dev/null -w '%{http_code} verify=%{ssl_verify_result}\n' https://example.com/
# 200 verify=0
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | grep 'Verify return code'
# Verify return code: 0 (ok)

The SSL/TLS checker shows the chain your server sends and whether a standard client can build it to a trusted root, independent of your machine's trust store.

• unable to verify the first certificate — the missing-intermediate variant, typical in Node.js
• self-signed certificate in certificate chain — the chain ends at a root you do not trust
• x509: certificate signed by unknown authority — the Go wording
• PKIX path building failed — the Java wording
• curl error 77 — curl could not even read its CA file
• Incomplete certificate chain — how to verify and fix it
• certificate has expired — a certificate in the chain is past notAfter