Certificate Errors

Diagnose and fix the certificate errors you actually hit, matched by their exact error string.

• unable to get local issuer certificate

  This OpenSSL verify error means the certificate chain is incomplete or the root CA is not trusted locally. Here is how to tell which of the two it is, and fix each.

• curl (60) SSL certificate problem

  Exit code 60 is curl refusing to trust a certificate, and the text after the colon says which check failed. Match your message to its cause and fix.

• PEM routines::no start line

  OpenSSL looked for a BEGIN line and did not find one. Either the file is DER and needs -inform der, or it is not the object type the command expects.

• wrong version number

  Almost always a TLS client talking to a plaintext port. Here is how to confirm that in one command, plus the three rarer causes worth checking.

• OpenSSL 3 cannot read my PFX

  OpenSSL 3 moved RC2 and 3DES into a legacy provider, so archives written by older tools fail — usually with a message that looks like a wrong password.

• bad decrypt

  The ciphertext was read but the key derived from your passphrase did not fit it. Usually a wrong password, or an OpenSSL version whose default digest changed.

• self signed certificate in certificate chain

  Verify error 19 means the chain terminates in a root your machine does not trust — usually a corporate TLS-inspecting proxy, or your own private CA.

• key values mismatch

  nginx or Apache is telling you the private key and certificate are from different key pairs. There is no repair — only finding the right key or reissuing.

• certificate has expired

  Verify error 10. Check whether it is the leaf or an intermediate that expired, and rule out a wrong system clock before renewing anything.

• NET::ERR_CERT_AUTHORITY_INVALID

  Chrome cannot build a path from the certificate to a root it trusts. Either the certificate is self-signed, the chain is incomplete, or a proxy is re-signing traffic.

• NET::ERR_CERT_COMMON_NAME_INVALID

  Chrome rejects the certificate because the hostname is not in its Subject Alternative Name list. The Common Name is ignored entirely, whatever it says.

• Python — CERTIFICATE_VERIFY_FAILED

  Python does not use the system trust store on macOS and often not in containers. Point it at the right CA bundle instead of disabling verification.

• PKIX path building failed

  Java keeps its own trust store, so a CA the rest of the machine trusts still fails inside the JVM. Here is how to find the missing CA and import it properly.

• Input not an X.509 certificate

  keytool refuses the file because it is not a bare certificate. Identify what you actually have — key, CSR, PKCS#12 or HTML — then convert or use the right command.

• Go — x509 certificate signed by unknown authority

  Go uses the system trust store, so this almost always means a scratch container with no CA bundle, or a corporate root that is not installed.

• UNABLE_TO_VERIFY_LEAF_SIGNATURE

  Node reports this when a server sends its certificate without the intermediates. Node never fetches a missing intermediate, so the chain has to be repaired.